-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Ralf,
- --On October 31, 2007 15:50:32 +0100 Ralf Kleineisel <[EMAIL PROTECTED]>
wrote:
| Hi,
|
| does a sequence failure in "nfdump -I" indicate 1 lost flow or maybe
| more than 1? E.g. if the sequence is 1, 2, 9, 10, is this 1 sequence
| failure or 6? How normal are sequence failures in your experience?
This counter just tells you how many time a sequence failure occurred. You have
not
direct relation to the number of records missing. At least you miss that many
records
as you have sequence failures, minimal 1 flow per failure, most likely you will
have
more.
Normal or not:
This depends on the weakest link from you router to the collector. Most likely
you
router will drop flows every now and then, on a busy network, or your OS will
drop
UDP packets, if the server is too busy. So some failures are considered not too
dramatic on large networks.
- Peter
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Splunk Inc.
| Still grepping through log files to find problems? Stop.
| Now Search log events and configuration files using AJAX and a browser.
| Download your FREE copy of Splunk now >> http://get.splunk.com/
| _______________________________________________
| Nfdump-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRynZg/5AbZRALNr/AQKqRgP8DeEs9HhrSFR1pfWMa6jywmChjXxY4T/A
jwUfZT+gFAsHFYPOIBoItIFU+QdzwYf9U/DySYIBg6i6dQWp8mwGgK5sXZHrhA+O
E7uXKuIfxpJt0LD891yRD4qWVIxYnw+351n01fe5YxVi/Rrwx0fC1KREa/o3Xmr1
4FABBtxH+0s=
=ll11
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
