I am testing J-Flow (Netflow) on an SRX-240 with ntop 4.0.3. I have J-Flow sampling set to (1) - which I believe means "sample" every packet.
Concerning "throughput" and possibly other metrics (such as total traffic / Bytes transferred): - SRX CLI show apx. 25Mb/s; 3,000 pps. - Cisco Switch interface statistics agree with this - within acceptable tolerances - ntop "Netflow" statistics agree with this - within acceptable tolerances HOWEVER nTop reports such as: "Summary Network Load", "Summary Traffic", "All Protocols Traffic" do NOT agree with "reality", typically showing a max of 4Mb/s 500pps. I have the flow-cache export timers set to 60 for active and 15 for inactive. I've been over 15Mb/s average with peaks of 30Mb/s for some time now, so this isn't just a quick burst that would get averaged out over time and appear less than reality. At this point I can't say where the problem lies. I would think if the ntop netflow stats align with the SRX interface stats that means the SRX is exporting the flow records accurately - but just a guess.... Any ideas or thoughts on next steps? Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
