On Mon, 2011-04-11 at 14:11 -0700, Rick Jones wrote:
> On Mon, 2011-04-11 at 15:50 -0500, Gary Gatten wrote:
> > I may have to read through this thread again, I'm confused. To my
> > knowledge snmp and/or rmon is the only way to get interface
> > "counters". Netflow, sflow, etc give you flow/conversation details.
>
> It may help to think of sFlow as "Shimmer" - it is both a floor wax
> *and* a dessert topping. An sflow agent can be configured to send flow
> samples (similar to netflow) or counter samples to an sflow collector,
actually that should be "and/or" - both can be happening at the same
time. I'd give an example of tcpdump output, but "in another thread"
I'm involved in issues with the correct decode of sflow PDUs :) I can
though show you some incomplete output:
16:47:41.409631 IP (tos 0x0, ttl 64, id 49088, offset 0, flags [none],
proto UDP (17), length 1348)
the-switch.54321 > z400.sflow: [udp sum ok] sFlowv5, IPv4 agent
the-switch, agent-id 0, seqnum 6903, uptime 2437130, samples 7, length
1320
flow sample (1), length 208,
flow sample (1), length 148,
flow sample (1), length 208,
counter sample (2), length 168,
counter sample (2), length 168,
counter sample (2), length 168,
counter sample (2), length 168,
> and it does appear that ntop can receive and do something useful with
> sflow counter samples.
>
> The Very Nice Thing about an sFlow counter sample is one gets all the
> counters in one shot - so instead of having to query each stat for an
> interface one at a time via SNMP, they all "just arrive" together in the
> same sFlow PDU. In fact, multiple counter samples, each from multiple
> interfaces, can be carried in the same sflow PDU making it even that
> much more efficient than querying via SNMP.
>
> rick
>
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
