Hello Peter,
Thank you very much for your explanation. It´s crystal clear.
The thing is that we have this collector that was receiving many templates with
different sampling rates (for every sampling-rate it receives a different
template), though the flows in that collector are all sampled with the same
rate (1:1000 in this case).
I would highly appreciate your comments regarding these templates and options,
if there is something wrong at these data-templates and options-templates.
Thank you very much again!
Martin.
-----Original Message-----
From: Peter Haag <pe...@pyxis.ch>
Sent: Friday, May 27, 2022 6:58 AM
To: Wolff, Martin (Nokia - UY/Montevideo) <martin.wo...@nokia.com>;
nfsen-discuss@lists.sourceforge.net
Subject: Re: [Nfsen-discuss] Nokia Router cflowd v9 monitoring with nfsen
Hi Martin,
BW is calculated per slot (nfcapd.x file):
BW = TotalBytes / duration
duration = timeslot interval
TotalBytes = the sum of all bytes values of all flows in that file
TotalBytes = sum(SamplingRate * BytesPerFlow)
btw. the same is true fo the packets
TotalPackets = sum(SamplingRate * PacketsPerFlow)
If you apply a negative sampling rate each bytes value is unconditionally
multiplied, as you explained correctly.
If you use a positive sampling rate the device announced rate is used. The
supplied -s rate is used until a valid sampling rate is announced.
NFv9 allows to announce sampling rates in multiple ways with different v9
elements. You may have a device global sampling rate, which applies to every
flow from that device. You may also have multiple sampling rates. This may be
true, if you have multiple exporters per device. Each exporter may have it's
own sampling rate configured.
nfcapd tracks all those possible announcements and applies sampling rates
accordingly. Therefore multiple sampling rates are possible in multiple
templates.
Most often, the problem is, that the device does not correctly implements these
different announcements, which may result in wrong byte/packet counts. That's
why the negative -s sampling rate exists.
The calculated BW is just an approach based on those values. SNMP values are
often unsampled and therefore result in a different value.
nfcapd does no magic here, it simply does the calculation, based on what a
device sends.
Hope, this helps
- Peter
On 26.05.22 15:48, Wolff, Martin (Nokia - UY/Montevideo) wrote:
> Hello nfsen community,
>
> We found a way to correct the issue:
>
> Nokia sends a data-template with an options-template (with the sampling rate
> stated there) for each sample-rate-profile. Each cflowd flow-set has the
> corresponding template associated with it according to the sample rate. The
> nfsen should use the template that corresponds to a given flow in a flow-set
> and calculate the BW according to the sum of the BW of all the flows,
> regardless of whether they have different sampling rates.
> In my opinion, there is where nfsen is "confused" and as a template arrives,
> it uses that one for all the flows arriving at that collector, so it is
> switching templates constantly, generating peaks if the templates change in a
> period of time greater than the time-slot of the bandwidth graph, or just
> having wrong values if its more often.
> By lowering the retransmit time of the templates from 600 seconds to 10,
> these template changes begin to occur within the same time-slot of 5 minutes,
> so the curve was smoothed though still wrong.
>
> So how we solved this situation?
> The -s argument was the key. It works like this: If it receives a sample rate
> from a template, it uses the one that comes from the device, only if no
> template arrives, it uses the value set by hand there. If the value of the
> argument is negative, it no longer cares what it receives from the team's
> templates and always uses that value set by hand. So we changed the -s value
> to negatives and voila! Problem solved.
>
> Though I am still intrigued about how nfsen calculates BW in this scenario,
> or if receiving multiple templates is not supported.
>
> Thanks!
> Martin.
>
> From: Wolff, Martin (Nokia - UY/Montevideo)
> Sent: Friday, May 20, 2022 12:15 PM
> To: nfsen-discuss@lists.sourceforge.net
> Subject: Nokia Router cflowd v9 monitoring with nfsen
>
> Hello nfsen community,
>
> We are using nfsen to monitor bandwidth from a Nokia 7750 SR-7s which is
> sending cflowd v9 data to the nfsen server. We have checked that the sampling
> rate is the same in the server configuration as in the router. Also active
> timeout is set to 1 minute while inactive timeout is 15 seconds. So there
> should not be any flow lasting longer than the 5 minute default graph points
> interval of nfsen wright?
>
> The packet bandwidth graphs are showing a spiky behavior and values 8 or more
> times bigger than what we see in SNMP graphs.
> After changing the template-retransmit timer from 600 seconds to 10 seconds,
> there was a big smoothing in the graphs and the BW difference was reduced
> from 8x to 2-3x times.
> I cannot get an idea of why a change in this retransmit timer could make any
> difference!
>
> Appreciate any hint about how does nfsen calculates the value of each average
> point for the bandwidth graphs. As I did it manually taking tcpdump
> information and performing a octects sum of all data received in 5 minutes *
> 8 to convert to bits * sampling rate to scale it up / 300 seconds to get the
> average --> This value is FINE and very similar to SNMP data.
>
> Appreciate any ideas about what could be happening here!
>
> Thanks!
> Martin.
>
>
>
> _______________________________________________
> Nfsen-discuss mailing list
> Nfsen-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
