-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Maurizio,
- -------- Original Message -------- From: Maurizio Molina <[EMAIL PROTECTED]> To: [email protected] Subject: Re:[Nfsen-discuss] How to configure sampling rate Date: Tue Sep 19 2006 14:36:33 GMT+0200 (CEST) > Peter Haag wrote: > >> >> -------- Original Message -------- >> From: Szymon Trocha <[EMAIL PROTECTED]> >> To: [email protected] >> Subject: [Nfsen-discuss] How to configure sampling rate >> Date: Thu Aug 31 2006 13:16:06 GMT+0200 (CEST) >> >>> Hi all, >>> I'm a new user of this application. >>> I have two sources of NetFlow v5 using two different sampling rates >>> each. How can I configure nfsen to display the exact and real traffic or >>> packet levels as it seems the graphs show much less traffic than it goes >>> through the routers (rather single Mbs then hundreds of Mbs). >>> I'm using nfsen-1.2.4 and nfdump-1.5.2 >> >> Up to know, you can not configure sampling rates, however a simple >> multiply may do the trick. >> I can prepare a patch for 1.2.4. Stay tuned. > > I'd like to remark that the re-normalization of netflow data after > sampling brings two issues: > 1) multiplying the number of packets and bytes by the inverse of the > sampling rate to obtain the real figure is an unbiased estimator (i.e. > it is correct), while for the number of flows it is not. Therefore, if > one chooses to give the re-normalized figure of the flows anyway, one > should at least add a warning that the information is not > representative of the real figure. > 2) Also for packets and bytes, the re-normalized figure is affected by > an uncertainty that should be reported along with the figure, not to > give the user eccessive "trust" in potentially wrong figures. There are > simple statistical formulas that can be applied and I'd be happy to > discuss them in the list, if there is consensus that this can be helpful. Yes - I'm aware of that. I'd appreciate any links/pointers/formulas regarding sampling. So far I did not find any useful information, why I still hesitated to implement simple math. - Peter > Regards, > Maurizio > >> - Peter >> >>> Thank you in advance and regards, >> >> -- >> _______ SWITCH - The Swiss Education and Research Network ______ >> Peter Haag, Security Engineer, Member of SWITCH CERT >> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 >> SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland >> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/security > > > ------------------------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, security? > Get stuff done quickly with pre-integrated technology to make your job > easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share your > opinions on IT & business topics through brief surveys -- and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > - -- _______ SWITCH - The Swiss Education and Research Network ______ Peter Haag, Security Engineer, Member of SWITCH CERT PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/security -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iQCVAwUBRRDukf5AbZRALNr/AQKb4QP9EhJzsdlFGY7HTLwBHpbWpaEd8gOzP4tN 81Zq8z8VEogADwWYp7PCRMhoi5up8RO0g+9yJdSJX12QMN4Y8IVKlXs+uBbief6v uYUlyxcoRHC9ZLSPvlG0Ey8urbBzuRy4VKDITsmo6q/HCl43XwRgKQtgQGMdlxbX Luk0ufg7FGg= =Zi5i -----END PGP SIGNATURE----- ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
