Hi Amit,
having the same packet sampled multiple times is not ideal for having
accurate data. Here are a few advices, depending on the scanario some
may apply, some may not:
* if the same packet could be sampled multiple times by the same switch
but in different VLANs, you can introduce VLANs while aggregating data
in sfacctd:
aggregate: src_host,dst_host,vlan
The result will be that if the packet is sampled multiple times while
traversing in different VLANs, each of these samples will contribute to
a distinct aggregate.
* if the same packet could be sampled multiple times but by different
switches, you can have a look to Pre-Tagging; basically samples received
by different switches will receive a different tag so that you can now
recognize which sample belongs to which switch:
pre_tag_map: /path/to/pretag.map
aggregate: src,host,dst_host,tag
Then inside the pretag.map:
id=1 ip=<IP address switch 1>
id=2 ip=<IP address switch 2>
...
* if, again, the same packet could be sampled multiple times by the
same switch but in different VLANs you can choose a single VLAN and
filter out all the remaining ones:
plugins: memory[a]
aggregate[a]: src_host,dst_host
aggregate_filter[a]: vlan <VLAN ID>
This method has limited applicability but has the pro of avoiding
duplicate data to finish in the memory table.
Hope this helps!
Cheers,
Paolo
On Wed, Dec 19, 2007 at 10:47:56PM +0530, Atharkar, Amit wrote:
> Hi Paolo,
>
> Thanks for replying.
>
>
> 1) Sampling rate is 512. Polling interval is 60 sec.
> 2) IF I make sfacctd_renormalize to false it gives the byte count in few
> bytes only.
> 3) The flow was initially traversed between two sflow enabled switches
> which were sending samples to same receiver. Sflow was disabled on one
> switch before taking the statistics.
> 4) Again Sflow is traversed twice in the same switch in different vlans.
>
>
> Network diagram is
>
> Sflow is enabled on this Switch. 6400cl is default router for ALL VLANS
> ======================
> | HP 6400cl |
> ======================
> #
> # 10GB Trunk (Present in all vlans of both
> switch)
> #
> ======================
> | | | | | | | HP 3400cl
> ======================
> All respective vlans are Present on both the switches.
>
> Sflow collector is connected to 3400cl switch. 3400cl is again connected
> to default gateway of company for internet connectivity.
>
> I am using sflowenable tool for setting up sflow mibs on 6400cl switch
>
> # setsflow 10.4.1.254 xxxxxxx 10.4.1.253 6343 512 60 604800 1
>
> Will you please let me know to deal with this situation?
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
