A good place to start is to just monitor the interface you should be seeing the sFlow packets come in on and make sure you see the sFlow packets themselves come in. If not, I can probably help with your Foundry config.
C -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, March 29, 2005 9:22 AM To: [email protected] Cc: [email protected] Subject: RE: [Ntop] sFlow not working! This IP/MASK is the one of my Network Foundry switch -> 172.16.2.251/255.255.255.0 and the one I've defined into the Virtual sFlow Interface Network Address, port is 6343, and debug has been set to On. A tailf on /var/log/message return the following (much more for sure): Mar 29 11:33:10 eyes ntop[8471]: sampleType COUNTERSSAMPLE Mar 29 11:33:10 eyes ntop[8471]: sampleSequenceNo 5651 Mar 29 11:33:10 eyes ntop[8471]: sourceId 0:19 Mar 29 11:33:10 eyes ntop[8471]: statsSamplingInterval 60 Mar 29 11:33:10 eyes ntop[8471]: counterBlockVersion 1 Mar 29 11:33:10 eyes ntop[8471]: ifIndex 19 Mar 29 11:33:10 eyes ntop[8471]: networkType 117 Mar 29 11:33:10 eyes ntop[8471]: ifSpeed 100000000 Mar 29 11:33:10 eyes ntop[8471]: ifDirection 1 Mar 29 11:33:10 eyes ntop[8471]: ifStatus 3 Mar 29 11:33:10 eyes ntop[8471]: ifInOctets 1151905399127 Mar 29 11:33:10 eyes ntop[8471]: ifInUcastPkts 1145225876 Mar 29 11:33:10 eyes ntop[8471]: ifInMulticastPkts 5444 Mar 29 11:33:10 eyes ntop[8471]: ifInBroadcastPkts 2562311 Mar 29 11:33:10 eyes ntop[8471]: ifInDiscards 0 Mar 29 11:33:10 eyes ntop[8471]: ifInErrors 1 Mar 29 11:33:10 eyes ntop[8471]: ifInUnknownProtos 0 Mar 29 11:33:10 eyes ntop[8471]: ifOutOctets 172371426642 Mar 29 11:33:10 eyes ntop[8471]: ifOutUcastPkts 704058492 Mar 29 11:33:10 eyes ntop[8471]: ifOutMulticastPkts 12849313 Mar 29 11:33:10 eyes ntop[8471]: ifOutBroadcastPkts 12397002 Mar 29 11:33:10 eyes ntop[8471]: ifOutDiscards 0 Mar 29 11:33:10 eyes ntop[8471]: ifOutErrors 0 Mar 29 11:33:10 eyes ntop[8471]: ifPromiscuousMode 1 Mar 29 11:33:10 eyes ntop[8471]: endSample ---------------------- Mar 29 11:33:11 eyes ntop[8471]: datagramSourceIP 251.2.16.172 Mar 29 11:33:11 eyes ntop[8471]: datagramSize 132 Mar 29 11:33:11 eyes ntop[8471]: unixSecondsUTC 1112113991 Mar 29 11:33:11 eyes ntop[8471]: datagramVersion 2 Mar 29 11:33:11 eyes ntop[8471]: agent 172.16.2.251 Mar 29 11:33:11 eyes ntop[8471]: packetSequenceNo 176510 Mar 29 11:33:11 eyes ntop[8471]: sysUpTime 4166505708 Mar 29 11:33:11 eyes ntop[8471]: samplesInPacket 1 Mar 29 11:33:11 eyes ntop[8471]: startSample ---------------------- Mar 29 11:33:11 eyes ntop[8471]: sampleType_tag 0:2 Mar 29 11:33:11 eyes ntop[8471]: sampleType COUNTERSSAMPLE Mar 29 11:33:11 eyes ntop[8471]: sampleSequenceNo 5652 Mar 29 11:33:11 eyes ntop[8471]: sourceId 0:21 Mar 29 11:33:11 eyes ntop[8471]: statsSamplingInterval 60 Mar 29 11:33:11 eyes ntop[8471]: counterBlockVersion 1 Mar 29 11:33:11 eyes ntop[8471]: ifIndex 21 Mar 29 11:33:11 eyes ntop[8471]: networkType 117 Mar 29 11:33:11 eyes ntop[8471]: ifSpeed 100000000 Mar 29 11:33:11 eyes ntop[8471]: ifDirection 1 Mar 29 11:33:11 eyes ntop[8471]: ifStatus 3 Mar 29 11:33:11 eyes ntop[8471]: ifInOctets 696722336339 Mar 29 11:33:11 eyes ntop[8471]: ifInUcastPkts 565653474 Mar 29 11:33:11 eyes ntop[8471]: ifInMulticastPkts 41 Mar 29 11:33:11 eyes ntop[8471]: ifInBroadcastPkts 92786 Mar 29 11:33:11 eyes ntop[8471]: ifInDiscards 0 Mar 29 11:33:11 eyes ntop[8471]: ifInErrors 2035717 Mar 29 11:33:11 eyes ntop[8471]: ifInUnknownProtos 0 Mar 29 11:33:11 eyes ntop[8471]: ifOutOctets 56464209045 Mar 29 11:33:11 eyes ntop[8471]: ifOutUcastPkts 342790372 Mar 29 11:33:11 eyes ntop[8471]: ifOutMulticastPkts 12852389 Mar 29 11:33:11 eyes ntop[8471]: ifOutBroadcastPkts 14864175 Mar 29 11:33:11 eyes ntop[8471]: ifOutDiscards 0 Mar 29 11:33:11 eyes ntop[8471]: ifOutErrors 0 Mar 29 11:33:11 eyes ntop[8471]: ifPromiscuousMode 1 Mar 29 11:33:11 eyes ntop[8471]: endSample ---------------------- > Sounds like it's not receiving data - are you sure you've configured > it and activated it? > > If so, then you'll have to rebuild with the debug switch for sflow and > see what's going on internally, but be prepared for a lot of output. > > -----Burton > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf > Of [EMAIL PROTECTED] > Sent: Tuesday, March 29, 2005 9:57 AM > To: [email protected] > Cc: [email protected] > Subject: RE: [Ntop] sFlow not working! > > This doens't help, no trafic at all are seem. If I look inside the > sFlow plugin page, I can see this at the end of the page: > > Number of Flows with Bad Data 0 > Total Number of Flows Processed 0 > > The sFlow Interface Statistics appears correctly. > It's look like the plugins work and receive data from the switch but > Ntop doesn't procced them. > >> Check the back traffic - this has come up before - IIRC there are two >> kinds of sFlow packets, one is some sort of summary which ntop sees >> and ignores. >> So you may not really be getting data. But I'm fuzzy on the details >> - google for it. Or check the FAQ and see if this makes sense: >> >> Q. sFlow doesn't work. >> A. Check this out: >> >> This talks about a bad experience I had setting up sFlow reception. >> For >> the longest >> time, I could see that ntop was getting sflow packets, but no >> data would show up. >> It turns out the switch I was exporting from didn't see any real >> traffic, and it was >> just sending COUNTERSAMPLE packets..... >> >> - - - - - - - - I figured out that it was indeed "invalid" sflow >> packets. >> >> Apparently, sflow sends COUNTERSAMPLE and FLOWSAMPLE packets. >> COUNTERSAMPLE packets >> give a quick look at interface counters on the machine, whereas >> FLOWSAMPLE packets >> are actual packet fragments from IP connections. Ntop seems to >> simply parse, >> debug_print, and discard COUNTERSAMPLE packets...which made it >> confusing to look at >> the debug output and say "wow, lots of sflow coming in!" when in >> fact it was just for >> show, as Burton suggested. I added more switches (with active >> connections) to the >> switches sending sflow packets and I now have hosts with pretty >> graphs. >> >> >> >> -----Burton >> >> -----Original Message----- >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf >> Of [EMAIL PROTECTED] >> Sent: Tuesday, March 29, 2005 8:14 AM >> To: [email protected] >> Subject: [Ntop] sFlow not working! >> >> Hello, >> >> I'm trying to activate sFlow with Ntop 3.1 and it's not working, no >> trafic visible. Here my config: >> >> sFlow version: 2.99 >> Local Collector UDP Port: 6343 >> Virtual sFlow Interface network Address: 172.16.0.0/255.255.0.0 >> >> Flow Senders IP is: 172.16.2.251 >> Flow Collector (Ntop) IP is: 172.16.1.215 >> >> Thanks, >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop ********************************************************************** Confidential/Proprietary Note The information in this email is confidential and may be legally privileged. Access to this email by anyone other than the intended addressee is unauthorized. If you are not the intended recipient of this message, any review, disclosure, copying, distribution, retention, or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you are not the intended recipient, please reply to or forward a copy of this message to the sender and delete the message, any attachments, and any copies thereof from your system. Thank you. Guardian Mortgage Documents, Inc. 225 Union Boulevard, Suite 200 Lakewood, CO 80228. ********************************************************************** _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
