http://www.acm.org/sigs/sigcomm/sigcomm2004/papers/p416-estan1.pdf#search=%22optimal%20netflow%20sample%20rate%22
On 9/20/06, Peter Haag <[EMAIL PROTECTED]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Maurizio, > > - -------- Original Message -------- > From: Maurizio Molina <[EMAIL PROTECTED]> > To: [email protected] > Subject: Re:[Nfsen-discuss] How to configure sampling rate > Date: Tue Sep 19 2006 14:36:33 GMT+0200 (CEST) > > > Peter Haag wrote: > > > >> > >> -------- Original Message -------- > >> From: Szymon Trocha <[EMAIL PROTECTED]> > >> To: [email protected] > >> Subject: [Nfsen-discuss] How to configure sampling rate > >> Date: Thu Aug 31 2006 13:16:06 GMT+0200 (CEST) > >> > >>> Hi all, > >>> I'm a new user of this application. > >>> I have two sources of NetFlow v5 using two different sampling rates > >>> each. How can I configure nfsen to display the exact and real traffic or > >>> packet levels as it seems the graphs show much less traffic than it goes > >>> through the routers (rather single Mbs then hundreds of Mbs). > >>> I'm using nfsen-1.2.4 and nfdump-1.5.2 > >> > >> Up to know, you can not configure sampling rates, however a simple > >> multiply may do the trick. > >> I can prepare a patch for 1.2.4. Stay tuned. > > > > I'd like to remark that the re-normalization of netflow data after > > sampling brings two issues: > > 1) multiplying the number of packets and bytes by the inverse of the > > sampling rate to obtain the real figure is an unbiased estimator (i.e. > > it is correct), while for the number of flows it is not. Therefore, if > > one chooses to give the re-normalized figure of the flows anyway, one > > should at least add a warning that the information is not > > representative of the real figure. > > 2) Also for packets and bytes, the re-normalized figure is affected by > > an uncertainty that should be reported along with the figure, not to > > give the user eccessive "trust" in potentially wrong figures. There are > > simple statistical formulas that can be applied and I'd be happy to > > discuss them in the list, if there is consensus that this can be helpful. > > Yes - I'm aware of that. I'd appreciate any links/pointers/formulas regarding > sampling. So far I did not find any useful information, why I still hesitated > to implement simple math. > > - Peter > > > Regards, > > Maurizio > > > >> - Peter > >> > >>> Thank you in advance and regards, > >> > >> -- > >> _______ SWITCH - The Swiss Education and Research Network ______ > >> Peter Haag, Security Engineer, Member of SWITCH CERT > >> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 > >> SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland > >> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/security > > > > > > ------------------------------------------------------------------------- > > Using Tomcat but need to do more? Need to support web services, security? > > Get stuff done quickly with pre-integrated technology to make your job > > easier > > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > > _______________________________________________ > > Nfsen-discuss mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > > > > > > ------------------------------------------------------------------------- > > Take Surveys. Earn Cash. Influence the Future of IT > > Join SourceForge.net's Techsay panel and you'll get the chance to share your > > opinions on IT & business topics through brief surveys -- and earn cash > > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > > _______________________________________________ > > Nfsen-discuss mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > > > > - -- > _______ SWITCH - The Swiss Education and Research Network ______ > Peter Haag, Security Engineer, Member of SWITCH CERT > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 > SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/security > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.3 (Darwin) > > iQCVAwUBRRDukf5AbZRALNr/AQKb4QP9EhJzsdlFGY7HTLwBHpbWpaEd8gOzP4tN > 81Zq8z8VEogADwWYp7PCRMhoi5up8RO0g+9yJdSJX12QMN4Y8IVKlXs+uBbief6v > uYUlyxcoRHC9ZLSPvlG0Ey8urbBzuRy4VKDITsmo6q/HCl43XwRgKQtgQGMdlxbX > Luk0ufg7FGg= > =Zi5i > -----END PGP SIGNATURE----- > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net's Techsay panel and you'll get the chance to share your > opinions on IT & business topics through brief surveys -- and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > -- Best Regards. ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
