-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Maurizio
- --On February 18, 2008 10:48:07 +0000 Maurizio Molina <[EMAIL PROTECTED]>
wrote:
| Hi,
| I'm using nfsen snapshot-20070312 and nfdump snpsht-20070312
|
| I frequently (say every few hours) see short periods (15-20') in which
| traffic from some routers drops almost to zero. Before investigating if
| something is wrong with the router or the communication channel with the
| collector, I think it's better to see if nfcapd is not loosing packets.
| I see that in nfsen.conf there's this conf parameter
|
| # Receive buffer size for nfcapd - see man page nfcapd(1)
| $BUFFLEN = 200000;
|
| -B bufflen
| Specifies the socket input buffer length in bytes. For high volume
| traffic ( near GB traffic ) it is recommended to set this value as
| high as possible ( typically > 100k ), otherwise you risk to lose
| packets. The default is OS (and kernel ) dependent.
|
| according to the above, I've set it to a safe value. The Netflow stream
| into my collector averages at 1-2 Mbit/s (but I don't know about peaks,
| they might actually be high, as the channels between the routers and the
| collectors are mostly Gbit/s ones...).
Generally, you are safe with the defaults provided. The default buffer should
be big enough. 1-2 MB/s is absolute no problem for nfcapd. The buffer is mostly
provided to cope with high peeks, at which the route may export the flows.
|
| So:
| 1) should I try some other value?
No - increasing this buff even more does not improve more.
| 2) if I do loose packets because of this buffer issue, would tehre be
| messages in the nfsen logs? which ones?
Loosing packets may occur anywhere in the chain from the exporter to the
collector.
nfcapd reports sequence failures via syslog, which covers all missing packets.
- Peter
|
| Thanks,
| Maurizio
|
| --
| ______________________________________________________________________
|
| Maurizio Molina
| Network Engineer
|
| DANTE - www.dante.net
|
| Tel: +44 (0)1223 371 300
| Fax: +44 (0)1223 371 371
| Email: [EMAIL PROTECTED]
| PGP Key ID: 3FF58D51
|
| City House, 126-130 Hills Road
| Cambridge CB2 1PQ
| UK
| _____________________________________________________________________
|
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Microsoft
| Defy all challenges. Microsoft(R) Visual Studio 2008.
| http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBR7l9cv5AbZRALNr/AQJpcAP/a+hBmpHDxj3+jzwXMzljaf60iAQf742K
fJGTCcDIKHRtiCr97ATQI0Wpp1lXu1OJbJZFbokQbzcA2u6ne3uG493i03sO8M8E
M3tKG/2JlTERogBCXsvi2+nOyYrYcQddfcriejXm4EmlUwzO/4VRF86Q0UjWhlqJ
zJA8zXPXg24=
=WpcN
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
