Hello Peter,
I too have some devices that export netflow and that use sampling (mostly
for lowering the CPU usage on the devices).
I generate custom graphs (using a custom backend plugin) and I multiply the
sampling rate with the actual value I get from the collector. This works
relatively fine for devices that use packet-based sampling.
For instance here I get 10% of the actual netflow exports. In this case I
multiply what I get by 10 and I have a pretty accurate estimation.
ip flow-sampling-mode packet-interval 10
ip flow-export source Loopback0
ip flow-export version 9 origin-as
There are other devices which can only do time based sampling:
mls sampling time-based 64
mls netflow sampling
In this case I haven't tried to estimate/correct the actual traffic (but
I'll try to see if you need my input).
It would be nice if the sample rate could be used to correct the graphs.
Hope my information is helpful.
Regards,
Adrian Popa
On 5/26/07, Peter Haag <[EMAIL PROTECTED]> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --On May 25, 2007 6:47:09 PM +0200 Erik Wenzel <[EMAIL PROTECTED]> wrote:
| Am Freitag, den 25.05.2007, 14:09 +0200 schrieb Peter Haag:
| [...]
| > I need some information from those of you using sampling in your
| > network.
| >
| > If you have several netflow sources you feed into NfSen, do all
| > the sources have the same sampling rate?
| >
| > If not, why do you have different sampling rate?
|
| >
| > Would it be feasible for you to adjust all sources to the same
| > sampling rate?
| Since I only know of box who accept one global netflow/sflow sample rate
| value, I think a per sources configurable value is sane.
This also also my guess, as building channels from different sources
with different sampling rates will become highly unpredictable, unless
you do only 1:1 channels. But as I have no operational experience
with samples netflow, I need some feedback from those running networks
with sampled netflow.
Thanks for the feedback
- Peter
|
|
|
|
-------------------------------------------------------------------------
| This SF.net email is sponsored by DB2 Express
| Download DB2 Express C - the FREE version of DB2 express and take
| control of your XML. No limits. Just data. Click to get it now.
| http://sourceforge.net/powerbar/db2/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRlfP0v5AbZRALNr/AQKQsgQAkO3Ph+FW5h+G+T3jIMQbYltWvV3OPSBx
kXAltYdJA7HchZIVot5yY3oeRuqoLNG7ytgakQSXQCHG8ZBHNQV52thc9UZ2fczr
XtK57Q5uKqNZXrGwvrM97TCvBEUWhHMZML/HyLQV/i1str7sMiAD9NqLCFKRp0w2
cLJ7JYYXu4s=
=++G7
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
