Hello nfsen community, We found a way to correct the issue:
Nokia sends a data-template with an options-template (with the sampling rate stated there) for each sample-rate-profile. Each cflowd flow-set has the corresponding template associated with it according to the sample rate. The nfsen should use the template that corresponds to a given flow in a flow-set and calculate the BW according to the sum of the BW of all the flows, regardless of whether they have different sampling rates. In my opinion, there is where nfsen is "confused" and as a template arrives, it uses that one for all the flows arriving at that collector, so it is switching templates constantly, generating peaks if the templates change in a period of time greater than the time-slot of the bandwidth graph, or just having wrong values if its more often. By lowering the retransmit time of the templates from 600 seconds to 10, these template changes begin to occur within the same time-slot of 5 minutes, so the curve was smoothed though still wrong. So how we solved this situation? The -s argument was the key. It works like this: If it receives a sample rate from a template, it uses the one that comes from the device, only if no template arrives, it uses the value set by hand there. If the value of the argument is negative, it no longer cares what it receives from the team's templates and always uses that value set by hand. So we changed the -s value to negatives and voila! Problem solved. Though I am still intrigued about how nfsen calculates BW in this scenario, or if receiving multiple templates is not supported. Thanks! Martin. From: Wolff, Martin (Nokia - UY/Montevideo) Sent: Friday, May 20, 2022 12:15 PM To: nfsen-discuss@lists.sourceforge.net Subject: Nokia Router cflowd v9 monitoring with nfsen Hello nfsen community, We are using nfsen to monitor bandwidth from a Nokia 7750 SR-7s which is sending cflowd v9 data to the nfsen server. We have checked that the sampling rate is the same in the server configuration as in the router. Also active timeout is set to 1 minute while inactive timeout is 15 seconds. So there should not be any flow lasting longer than the 5 minute default graph points interval of nfsen wright? The packet bandwidth graphs are showing a spiky behavior and values 8 or more times bigger than what we see in SNMP graphs. After changing the template-retransmit timer from 600 seconds to 10 seconds, there was a big smoothing in the graphs and the BW difference was reduced from 8x to 2-3x times. I cannot get an idea of why a change in this retransmit timer could make any difference! Appreciate any hint about how does nfsen calculates the value of each average point for the bandwidth graphs. As I did it manually taking tcpdump information and performing a octects sum of all data received in 5 minutes * 8 to convert to bits * sampling rate to scale it up / 300 seconds to get the average --> This value is FINE and very similar to SNMP data. Appreciate any ideas about what could be happening here! Thanks! Martin.
_______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
