Hi Oussama, OK. Thing is we should first of all be sure you are comparing apples with apples and hence review your test methodology. By crafting a filter, ie. pcap_filter in pmacctd maybe something similar exists in host sflow, you can focus on a specific host (where you do a file transfer or so) and filter out all the rest. Then you can compare results. If not good, like now, you can inspect sFlow generated by host sflow with Wireshark (or sflowtool which gives you simple text output) so to see it's according to expectations (ie. if you sum bytes counter seen via sFlow: is it rougly 1:100 as expected?). Only then we can have a look to sfacctd behaviour - hope it helps and makes sense.
Cheers, Paolo On Mon, Sep 09, 2013 at 09:58:57AM +0100, oussama sarhraoui wrote: > Hi Paolo, > I definitly need a lightweight solution so it is sflow, and i use 'host > sflow' with ulog to provide flow samples ( > http://blog.sflow.com/2010/12/ulog.html ). > i suppose that pmacctd is more accurate because i understand and correct me > that it uses a promiscuous mode. tests are runing on a local machine. > thanks for replying so quickly. > > > 2013/9/9 Paolo Lucente <[email protected]> > > > Hi Oussama, > > > > Can you elaborate on your target deployment for billing (ie. sFlow > > or promiscuous mode)? Can you also elaborate on the setup for your > > test? What tool is generating sFlow data being sent to sfacctd? If > > you have control over the host 192.168.42.226: which of the two > > counters looks the most accurate (354000 or 1096303)? > > > > Cheers, > > Paolo > > > > On Sun, Sep 08, 2013 at 12:05:31PM +0000, oussama sarhraoui wrote: > > > I'm actually testing pmacct tools for a potential integration into our > > > system to perform billing operations . So it is important for us to get > > the > > > most accurate information from these tools. so i run sfacctd and pmacctd > > on > > > a local machine with host sflow configured with the ULOG facility to > > > collect traffic samples with a sampling rate 1 in 100. > > > i used to following configuration within sfacctd : > > > > > > daemonize: true > > > plugins: memory[ins], memory[outs] > > > interface: eth0 > > > sfacctd_ip: 192.168.42.226 > > > sfacctd_port: 6343 > > > sfacctd_renormalize: true > > > aggregate[ins]: dst_host > > > aggregate_filter[ins]: src net 173.194.0.0/16 > > > aggregate[outs]: src_host > > > aggregate_filter[outs]: dst net 173.194.0.0/16 > > > imt_path[ins]: /tmp/pmacct_ins.pipe > > > imt_path[outs]: /tmp/pmacct_outs.pipe > > > ! > > > > > > and the following for pmacctd : > > > > > > daemonize: true > > > plugins: memory[in], memory[out] > > > interface: eth0 > > > aggregate[in]: dst_host > > > aggregate_filter[in]: src net 173.194.0.0/16 > > > aggregate[out]: src_host > > > aggregate_filter[out]: dst net 173.194.0.0/16 > > > imt_path[in]: /tmp/pmacct_in.pipe > > > imt_path[out]: /tmp/pmacct_out.pipe > > > ! > > > > > > the problem is that i found a big difference between these two tools : > > > sfacctd shows : > > > > > > DST_IP PACKETS BYTES > > > 192.168.42.226 1600 354000 > > > > > > and pmacctd shows : > > > > > > DST_IP PACKETS BYTES > > > 192.168.42.226 1718 1096303 > > > > > > thanks for any remarque or suggestion and for help :) > > > > > > cheers. > > > > > > -- > > > *SARHRAOUI Oussama * > > > > > _______________________________________________ > > > pmacct-discussion mailing list > > > http://www.pmacct.net/#mailinglists > > > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > > > > > -- > *SARHRAOUI Oussama * _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
