On 29/5/2015 12:39 μμ, Nikolaos Milas wrote:
> Packet Stats seem to be magnified by a very large factor, est. at
> 100,000 (100K). That is, when the real packet traffic is at 100
> packets/sec, the stats show it as 10M/s (approximate estimation)!
>
> Can you please help me in identifying the cause of this behavior and
> suggest a solution?
Hello,
I am still struggling with this problem.
I temporarily switched to Cisco IPv4 FNF (flexible netflow) but I
obviously (as I found later) ran into this problem:
https://supportforums.cisco.com/discussion/11686271/switching-flexible-netflow-increases-cpu-load
After our routers suffered 100% load, I had to switch back to normal
IPv4 netflow (with CEF fully enabled) and IPv4 netflow seems to be
working correctly, but currently I am testing with:
ip flow ingress
ip flow egress
...configured ONLY on the ISP interface.
However, as I found out, IPv6 FNF exporting (the only available IPv6
netflow export method on this IOS version) magnifies traffic and packets
(not flows) by an estimated factor of about 100K.
I have been obliged to stop (at least temporarily) IPv6 recording,
because it distorts real traffic graphs (data is collected and graphs
are generated by nfdump/nfsen).
Perhaps the "record" statement (in flow monitor configuration) should be
configured differently?
What may be wrong?
I experimented a bit with sampling rates, but without success. What
makes things more complex is that IPv4 netflow data seem to be OK
(conventional netflow export) whereas IPv6 (using FNF) does not.
So, how could a sampling rate correction in nfsen correct the problem,
since only IPv6 exported netflow data present the issue?
Please advise.
Thanks in advance,
Nick
------------------------------------------------------------------------------
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
