Peter Haag wrote: > > > -------- Original Message -------- > From: Szymon Trocha <[EMAIL PROTECTED]> > To: [email protected] > Subject: [Nfsen-discuss] How to configure sampling rate > Date: Thu Aug 31 2006 13:16:06 GMT+0200 (CEST) > > >Hi all, > > >I'm a new user of this application. > > >I have two sources of NetFlow v5 using two different sampling rates > >each. How can I configure nfsen to display the exact and real traffic or > >packet levels as it seems the graphs show much less traffic than it goes > >through the routers (rather single Mbs then hundreds of Mbs). > > >I'm using nfsen-1.2.4 and nfdump-1.5.2 > > > Up to know, you can not configure sampling rates, however a simple > multiply may do the trick. > I can prepare a patch for 1.2.4. Stay tuned.
I'd like to remark that the re-normalization of netflow data after sampling brings two issues: 1) multiplying the number of packets and bytes by the inverse of the sampling rate to obtain the real figure is an unbiased estimator (i.e. it is correct), while for the number of flows it is not. Therefore, if one chooses to give the re-normalized figure of the flows anyway, one should at least add a warning that the information is not representative of the real figure. 2) Also for packets and bytes, the re-normalized figure is affected by an uncertainty that should be reported along with the figure, not to give the user eccessive "trust" in potentially wrong figures. There are simple statistical formulas that can be applied and I'd be happy to discuss them in the list, if there is consensus that this can be helpful. Regards, Maurizio > - Peter > > >Thank you in advance and regards, > > > -- > _______ SWITCH - The Swiss Education and Research Network ______ > Peter Haag, Security Engineer, Member of SWITCH CERT > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 > SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/security ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
