Yann Berthier wrote:
> Hello,
>
>On Thu, 02 Aug 2007, at 17:28, Maurizio Molina wrote:
>
>
>
>>But the active timeout in my routers is 300 sec!!, so I would expect to
>>see a persistent flow to be exported, at most, 1 time every 5 minutes.
>>Also, it cannot be due to the inactive timeout (which in my routers is
>>60 s).
>>
>>
>
> I don't understand your point - it looks like your flows are exported
> roughly every 300 s (see the duration)
>
>
I'm puzzled because every 300s I get (roughly) 10 more flows with this
same 5-tuple (see the reported number of aggregated flows: 10,20, 28,
35, ....). So I guess that this is the result of 10 separate exports
(why???), than are then aggregated into one flow. The duration of the
*aggregated* flow is probably referred to the difference between the
first and last packet of all these flows, and then it's reasonable that
it increases by 300 s every 300 s.
> Is your router a Juniper ?
>
>
>
yes - Junos release 8.2
Here's the part relevant for the Netflow configuration.
sampling {
traceoptions {
file sampled.trace size 3m;
}
input {
family inet {
rate 1000;
}
}
output {
cflowd X.Y.W.Z {
port 7712;
version 5;
no-local-dump;
autonomous-system-type peer;
}
flow-active-timeout 300;
}
}
As you see, active timeout is configured to 300s, Inactive timeout is
not explicitly configured, than it's teh default (60s), according to
http://www.juniper.net/techpubs/software/junos/junos82/swconfig82-services/html/flow-monitoring-summary29.html#1055868
Maurizio
>>Any hint? CAn anybody check, by identifying a persistent flow their
>>network, if they observe a behavior consistent with their active timeout?
>>
>>Date flow start Duration Proto Src IP Addr:Port
>>Dst IP Addr:Port Packets Bytes Flows
>>5 min slot
>>2007-07-26 22:19:46.432 270.910 TCP x.138.4.19:22 ->
>>y.220.165.210:48117 580 806816 10
>>10 min slot
>>2007-07-26 22:19:46.432 571.423 TCP x.138.4.19:22 ->
>>y.220.165.210:48117 1013 1410084 20
>>15 min slot
>>2007-07-26 22:19:46.432 814.342 TCP x.138.4.19:22 ->
>>y.220.165.210:48117 1469 2048588 28
>>20 min slot
>>2007-07-26 22:19:46.432 1160.044 TCP x.138.4.19:22 ->
>>y.220.165.210:48117 2099 2935420 35
>>......
>>60 min slot
>>2007-07-26 22:19:46.432 3521.209 TCP x.138.4.19:22 ->
>>y.220.165.210:48117 6048 8441088 112
>>
>>
>>-------------------------------------------------------------------------
>>This SF.net email is sponsored by: Splunk Inc.
>>Still grepping through log files to find problems? Stop.
>>Now Search log events and configuration files using AJAX and a browser.
>>Download your FREE copy of Splunk now >> http://get.splunk.com/
>>_______________________________________________
>>Nfsen-discuss mailing list
>>[email protected]
>>https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>>
>>
>
>
>
--
______________________________________________________________________
Maurizio Molina
Network Engineer
DANTE - www.dante.net
Tel: +44 (0)1223 371 300
Fax: +44 (0)1223 371 371
Email: [EMAIL PROTECTED]
PGP Key ID: 3FF58D51
City House, 126-130 Hills Road
Cambridge CB2 1PQ
UK
_____________________________________________________________________
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
