I have recently started using NFSen and have found it very helpful. I am
confused by one aspect that I am trying to understand. I am exporting sflow
from Brocade CER routers to NFSen.
When I list the flows using various criteria, the packet count is almost always
2048:
Date flow start Duration Proto Src IP Addr:Port Dst IP
Addr:Port Packets Bytes Flows
** nfdump -M /opt/nfsen/profiles-data/live/kc-gateway2:kc-gateway1 -T -r
2012/08/13/nfcapd.201208131030 -c 100
nfdump filter:
proto TCP
and port 80
Date flow start Duration Proto Src IP Addr:Port Dst IP
Addr:Port Packets Bytes Flows
2012-08-13 10:30:01.087 0.000 TCP 205.158.21.133:7608 ->
188.77.80.212:80 2048 143360 1
2012-08-13 10:30:03.274 0.000 TCP 69.46.39.45:80 ->
188.77.82.99:10190 2048 3.1 M 1
2012-08-13 10:30:04.323 0.000 TCP 173.227.73.11:57759 ->
188.77.82.5:80 2048 3.1 M 1
2012-08-13 10:30:06.443 0.000 TCP 37.152.35.146:51603 ->
144.120.106.200:80 2048 3.0 M 1
2012-08-13 10:30:11.458 0.000 TCP 188.77.82.211:17506 ->
66.129.99.105:80 2048 735232 1
2012-08-13 10:30:15.854 0.000 TCP 188.77.82.62:80 ->
108.162.231.67:62325 2048 3.1 M 1
2012-08-13 10:30:15.854 0.000 TCP 50.63.136.26:80 ->
188.77.80.102:57781 2048 1.3 M 1
2012-08-13 10:30:16.459 0.000 TCP 108.162.231.67:62325 ->
188.77.82.62:80 2048 143360 1
2012-08-13 10:30:24.397 0.000 TCP 188.77.82.231:80 ->
161.130.18.74:2216 2048 2.9 M 1
2012-08-13 10:30:26.512 0.000 TCP 188.77.82.62:80 ->
173.245.55.25:64903 2048 3.1 M 1
2012-08-13 10:30:27.065 0.000 TCP 173.245.55.25:48851 ->
188.77.82.62:80 2048 143360 1
2012-08-13 10:30:30.242 0.000 TCP 188.77.82.231:80 ->
24.171.62.218:1955 2048 3.1 M 1
2012-08-13 10:30:30.771 0.000 TCP 188.77.82.5:80 ->
64.132.190.14:3395 2048 731136 1
2012-08-13 10:30:37.796 0.000 TCP 144.120.106.200:80 ->
89.242.6.248:64535 2048 118784 1
I assume this had something to do with the fact that by default the Brocades
are by default sampling 1 out of every 2048 packets and therefore only seeing 1
packet out of most of these short lived flows.
Is this assumption correct? Is nfdump just estimating that a flow is going to
have a minimum of 2048 packets as a result?
Is there anyone else running sflow out there? What sampling rates do you use?
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
