From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Yang, Paul P
Sent: Tuesday, June 21, 2005 8:25 PM
To: [email protected]
Subject: [Ntop] Displaying sflow information
Hi,
I just got the
windows demo version of ntop up and running and I am trying to get it to display
sflow information. However, ntop doesn't display anything, even though it
says it's receiving packets. I found the answer to this problem in the
ntop faq http://www.ntopsupport.com/faq.html:
Q. sFlow doesn't work.
A. Check
this out:
This talks about a bad
experience I had setting up sFlow reception. For the longest time, I could see
that ntop was getting sflow packets, but no data would show up. It turns
out the switch I was exporting from didn't see any real traffic, and it was just
sending COUNTERSAMPLE packets.....
- - - - - - - - I figured out that it was indeed "invalid" sflow packets. Apparently, sflow sends COUNTERSAMPLE and FLOWSAMPLE packets. COUNTERSAMPLE packets give a quick look at interface counters on the machine, whereas FLOWSAMPLE packets are actual packet fragments from IP connections. Ntop seems to simply parse, debug_print, and discard COUNTERSAMPLE packets...which made it confusing to look at the debug output and say "wow, lots of sflow coming in!" when in fact it was just for show, as Burton suggested. I added more switches (with active connections) to the switches sending sflow packets and I now have hosts with pretty graphs.
This seems to answer my question, but I don't understand what happened at the end. Did the Flowsample packets start coming in simply because he set up more switches and active connections? My setup right now is just the switch and a laptop running its own private network, and I am indeed receiving just the Countersample packets. Is it possible to configure sflow to send the necessary Flowsample packets using my bare minimum network, or do I have to hook up the switch to some active connections?
My main question is: Is it because I'm setting up sflow wrong that I'm receiving the Countersample packets rather than Flowsample packets?
Thanks!
Paul Yang
Lockheed
Martin Space Systems Company
Advanced
Technology Center
Org ABCS, Bldg 153
1111 Lockheed Martin Way
Sunnyvale, CA 94089
Office Phone:
408.742.8461
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
