On Sun, 24 Feb 2013, Piotr wrote:
I'd like ask about this options, I made some test sampling with nfdump+nfsen and i don't see the difference wheter this option is on or off. What is exactly advantages and disadvantages of this option in practise ?
If you do, for example, 1 out-of 100 sampling with a run-length of 4, you will sample one packet out of 100, plus the next 4 packets, so you're functionally sampling 5 packets out of 100.
The reason your nfsen graphs don't look any different is because nfsen/ndfump don't know what to do with those extra 4 packets. If you want 5 out-of 100 sampling to show up in your graphs, you'd need to changing your sampling rate to 1 out-of 20, and not use the 'run-length' feature, and then change the expected sampling rate in nfsen accordingly.
jms _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
