-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton Strauss
Sent: Tuesday, June 21, 2005 10:27 PM
To: [email protected]
Subject: RE: [Ntop] Displaying sflow informationYes.You need to configure your sFlow sender to send FLOWSAMPLE packets. You can send CONTERSAMPLE or not, they're just ignored.-----Burton
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Yang, Paul P
Sent: Tuesday, June 21, 2005 8:25 PM
To: [email protected]
Subject: [Ntop] Displaying sflow informationHi,
I just got the windows demo version of ntop up and running and I am trying to get it to display sflow information. However, ntop doesn't display anything, even though it says it's receiving packets. I found the answer to this problem in the ntop faq http://www.ntopsupport.com/faq.html:Q. sFlow doesn't work.
A. Check this out:
This talks about a bad experience I had setting up sFlow reception. For the longest time, I could see that ntop was getting sflow packets, but no data would show up. It turns out the switch I was exporting from didn't see any real traffic, and it was just sending COUNTERSAMPLE packets.....- - - - - - - - I figured out that it was indeed "invalid" sflow packets. Apparently, sflow sends COUNTERSAMPLE and FLOWSAMPLE packets. COUNTERSAMPLE packets give a quick look at interface counters on the machine, whereas FLOWSAMPLE packets are actual packet fragments from IP connections. Ntop seems to simply parse, debug_print, and discard COUNTERSAMPLE packets...which made it confusing to look at the debug output and say "wow, lots of sflow coming in!" when in fact it was just for show, as Burton suggested. I added more switches (with active connections) to the switches sending sflow packets and I now have hosts with pretty graphs.
This seems to answer my question, but I don't understand what happened at the end. Did the Flowsample packets start coming in simply because he set up more switches and active connections? My setup right now is just the switch and a laptop running its own private network, and I am indeed receiving just the Countersample packets. Is it possible to configure sflow to send the necessary Flowsample packets using my bare minimum network, or do I have to hook up the switch to some active connections?
My main question is: Is it because I'm setting up sflow wrong that I'm receiving the Countersample packets rather than Flowsample packets?
Thanks!
Paul Yang
Lockheed Martin Space Systems Company
Advanced Technology Center
Org ABCS, Bldg 153
1111 Lockheed Martin Way
Sunnyvale, CA 94089
Office Phone: 408.742.8461
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
