On Dec 03, 2004 07:59 AM, Burton Strauss <[EMAIL PROTECTED]> wrote: >Read the back traffic on this list - IIRC there are two types of sFlow >messages, a sort of summary (which ntop ignores) and the details. >Somebody >else went through this and posted back his experiences. > >-----Burton > >-----Original Message----- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of >Robert Brewer >Sent: Thursday, December 02, 2004 6:24 PM >To: [EMAIL PROTECTED] >Subject: [Ntop] Foundry sFlow -> ntop 3.0 problems > >I'm trying to get a Foundry FastIron Edge Switch 4802 to send sFlow >data to >ntop 3.0 running on FreeBSD 4.10. The FES 4802 is running version >03.1.02Tc3, ntop was built from ports on FreeBSD. > >After some confusion getting the sFlow plugin working in ntop (I got it >into >a state where the sFlow plugin was enabled, but no sFlow interface >would >show up in the Switch NIC section), I think the FES is sending sFlow >data to >ntop: > >[EMAIL PROTECTED](config)#show sflow >sFlow services are enabled. >sFlow agent IP address: 64.65.64.153 >Collector IP 64.65.64.59, UDP 6343 >Polling interval is 20 seconds. >Configured default sampling rate: 1 per 1024 packets. >Actual default sampling rate: 1 per 1024 packets. >83 UDP packets exported >66 sFlow samples collected. >sFlow ports: ethe 1 >Port Sampling Rates >------------------- >Port=1, configured rate=1024, actual rate=1024 > >However ntop doesn't seem to be getting any data after I Switch NIC to >the >sflow virtual device, all pages are either blank or say there is no >data. >Then I turned on sFlow debugging, and the log fills with this message >repeated over and over: > >Wed Dec 1 16:38:20 2004 SFLOW_DEBUG: rawSampleLen: rc=-1 > >Any suggestions on how to get this going? The FES isn't seeing any >traffic >worth mentioning, so I don't think it is a load issue. > >I also am confused by the sFlow plugin setup. If I switch sFlow off, >shutdown ntop, restart ntop and re-enable sFlow then I can see the >sFlow >interface in Switch NIC. However if I shut down ntop and restart it, >the >sFlow plugin shows enabled, but Switch NIC reports that I am only >capturing >traffic from the server's ethernet interface de0. How do I keep sFlow >going >between ntop restarts? > >Mahalo! >-- >Robert Brewer >Assistant Manager, System Department >LavaNet, Inc. [EMAIL PROTECTED] > >-- >Robert Brewer ph: 808-532-8246 >Assistant Manager, System Department fax: 808-532-8246 >LavaNet, Inc. [EMAIL PROTECTED] >_______________________________________________ It is a tad bit on the klugy side but it will work. One Redhat/Fedora I have the best success when I do not set --interface none. I then flip it on via the admin gui and start getting the stats. Sometime you have to flip the sflow plugin on and off to be able to set the Network Interface switch.
Ted DISCLAIMER This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited. If you have received this e-mail in error, please immediately notify me and permanently delete the original and any copy of any e-mail and any printout thereof. E-mail transmission cannot be guaranteed to be secure or error-free. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. REGARDING PRIVACY AND CONFIDENTIALITY Crown Financial Group may, at its discretion, monitor and review the content of all e-mail communications.
BEGIN:VCARD VERSION:2.1 N:Kaczmarek;Ted;; FN:Ted Kaczmarek ORG:Crown Financial Group Inc.; NOTE:tkaczmar TEL;WORK;VOICE: TEL;CELL;VOICE: TEL;PAGER;VOICE: TEL;WORK;FAX: ADR;WORK:;;;;;;Tuxworld LABEL;WORK;ENCODING=QUOTED-PRINTABLE:=0D=0A, =0D=0AD URL;WORK: EMAIL;PREF;INTERNET:[EMAIL PROTECTED] MAILER:OPEN-XCHANGE END:VCARD
_______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
