Hi Peter & list,
Peter Haag wrote:
> I need some information from those of you using sampling in your
> network.
>
> If you have several netflow sources you feed into NfSen, do all
> the sources have the same sampling rate?
>
> If not, why do you have different sampling rate?
I run a different sampling rate between some of our devices as they do
not all support the same rate. I would like to sample at 1/100, but some
brands that we use only support 1/10000 or 1/1000. So, overall we have
1/100, with some exceptions. I would like to be able to normalise the
sources with lower frequency, to a higher one, since they are the odd
ones out.
> Would it be feasible for you to adjust all sources to the same
> sampling rate?
Not really, it's my belief that a 1/10000 sampling rate will not give us
enough information.
> Have you best practices formulas for estimating real traffic, or
> do you operate just using a multiplication with the sampling rate?
At this time, all that I do is generate a report that says "multiply by
factor x", but it would be a nice start if nfsen could already do a
simple multiplication function for each source depending on the sample
rate configured for that source. What I am primarly interested in right
now is seeing for example what the estimated amount of traffic in the
direction of different AS's is.
> Input is appreciated for implementing a proper way of sampling into NfSen.
Thanks for all your hard work on this Peter, it would be very nice if a
good way of normalising different sources according to their sampling
rates could be achieved.
~paul
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
