Seems like it would be simple - multiply rx stats by sample rate before storing/graphing? I don't do much development so who knows.
I would maybe try without sampling, but maybe set your active/inactive timers to 120/60? It's not as real-time as it could be, but if you have a ton of dynamic traffic it will slow down the flow rate. I'm only seeing traffic of around 100Kpps, but I'm on an old P-III and it's only using 25% during peaks. Surely a fast box can keep up with netflow exports from really high util - unless every packet is a different "flow" - like during some sort of DoS attack. G ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Kyle McLerren Sent: Thursday, February 12, 2009 4:03 PM To: [email protected] Subject: Re: [Ntop] Ntop NetFlow Question Thanks for the response. We are doing a boat load of traffic. We had to enable sampling because our previous collector could no longer cope with the sheer volume of flows it was trying to process. I do admit I dont know if ntop can process the flows better as I just started to use it. Previous we were using flow-tools and flowscan/cuflow. I should not have said "accurate," as they are prefectly accurate. It just others get confuse when looking at them and it gets old telling people to keep in mind the data is accurate, its just the numbers are "smaller" then they actually really are :) so it looks like the answer is no, there isnt a way to set the sample rate.. seems like a really basic and easy feature to implement, would be great to see it! thanks again. On Thu, Feb 12, 2009 at 1:54 PM, Gary Gatten <[email protected]> wrote: How'd anyone ever function without Google? http://www.mail-archive.com/[email protected]/msg11605.html ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Gary Gatten Sent: Thursday, February 12, 2009 3:49 PM To: [email protected] Subject: Re: [Ntop] Ntop NetFlow Question I have seen this asked and I think answered a couple times, but since I don't do sampling I wasn't paying much attention. I'm sure if you searched the list you'd see some answers from Luca and/or Burton. I searched the FAQ and man page and couldn't find anything. Also checked the "Preferences" and couldn't see anything there either. MAYBE check the globals-define.h; there's lots of cool stuff in there but you have to recompile with changes :-( Of course the easy answer is to NOT sample. Unless you have a $HIT load of traffic it will be OK, especially if you set the active/inactive export timers to something reasonable. BTW: What is "not accurate"? ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Kyle McLerren Sent: Thursday, February 12, 2009 3:13 PM To: [email protected] Subject: [Ntop] Ntop NetFlow Question Hi All, Im sure this has been answered before, but I couldnt find an answer anywhere. I use sampled netflow, and I simply wanted to know if theres an option with the ntop netflow plugin to configure the sample rate? Otherwise, my results arent acurate. Im sending 1 out of 100 from my router. thanks! "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
