Hi Amit, the strange thing is that 65MB is exactly five times 13MB. Which sampling rate are you using? How things change by playing around the sfacctd_renormalize option? Is it possible the data flow is being over-estimated because, say, it's traversing multiple sFlow- enabled switches or because it's routed and passes through the same switch multiple times, maybe in different VLANs? Lastly, can you also say which direction is the sFlow agent sampling traffic (incoming or outgoing)?
Cheers, Paolo On Mon, Dec 17, 2007 at 06:31:03PM +0530, Atharkar, Amit wrote: > Hi all, > > > > I am using pmacctd 0.11.4 to collect sflow data from HP 3400cl. I am > able to receive the traffic but the byte count is weired. Reports shows > around 65 MB for 13 MB file download. > > > > As suggested by Paolo sfacctd_renormalize is also enabled. > > > > Can someone help me to make accounting more accurate? > > > > Sfacctd.conf > > ===================== > > daemonize: false > > debug: true > > plugins: pgsql > > print_refresh_time: 20 > > aggregate:src_host,dst_host > > interface: eth0 > > promisc: false > > sfacctd_renormalize: true > > sql_db: pmacct > > sql_data: typed > > sql_passwd: pmacct12 > > sql_table_version: 4 > > sql_table: acct_v4 > > sql_refresh_time: 30 > > sql_history: 5m > > sql_history_roundoff: m > > snaplen: 750 > > ==================== > > > > Amit _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
