Hi,
I'm currently in the process of migrating from a monitoring and
accounting setup based on pmacctd/libpcap to sfacctd/sflow. However,
while doing so I ran into a few things:
* Can sfacctd somehow also "process" the polled (interface globals)
data?
* How can one "decipher" the IN_IFACE and OUT_IFACE fields? For
example:
TAG,TAG2,CLASS,SRC_MAC,DST_MAC,VLAN,COS,ETYPE,SRC_AS,DST_AS,BGP_COMMS,AS_PATH,PREF,MED,PEER_SRC_AS,PEER_DST_AS,PEER_SRC_IP,PEER_DST_IP,IN_IFACE,OUT_IFACE,MPLS_VPN_RD,SRC_IP,DST_IP,SRC_MASK,DST_MASK,SRC_PORT,DST_PORT,TCP_FLAGS,PROTOCOL,TOS,PACKETS,FLOWS,BYTES
0,0,unknown,00:00:00:00:00:00,00:00:00:00:00:00,0,0,0,0,0,0,,0,0,0,0,10.255.255.12,,211,48,0:0:0,10.255.255.2,10.255.255.1,0,0,0,0,0,icmp,0,2,0,204
0,0,unknown,00:00:00:00:00:00,00:00:00:00:00:00,0,0,0,0,0,0,,0,0,0,0,10.255.255.12,,1073741823,1073741823,0:0:0,10.255.255.1,10.255.255.2,0,0,0,0,0,icmp,0,1,0,102
I have a continuous ping running between 10.255.255.1 and 10.255.255.2
which passes ports that are sampled by sFlow. However, the ports 211, 48
and 1073741823 look rather bogus to me. So either my switches (HP 2920)
send garbled data, or some more effort is needed to turn it into
something useful.
On a slightly related note, but probably rather off-topic: what are
commonly used free methods of generating lots of network traffic.
Ideally it would be something that could create several hundred Mbps of
random traffic.
