Firstly, thanks for the excellent community support on pmacct!

I have a question regarding how sfacctd counts packets for sFlow sampled
ethernet flows. I have written a simple sFlow agent in Python which is
scraping counters from a legacy, procfs-based counter source, and faking
sFlow sampled ethernet flows. I've diligently studied the sFlow spec, and
the faked samples look totally fine in sflowtool and Wireshark. Feeding
them to sfacctd is correctly counting the bytes, however the packet
counters are only monotonically incremented for each sample received.

The sfacctd.conf is about as simple as can be for now:

plugins: memory
aggregate: src_mac, dst_mac

Dumping the in-memory counters:

$ pmacct -s
SRC_MAC            DST_MAC            PACKETS               BYTES
00:de:ad:be:ef:00  00:00:00:00:00:00  270                   219773
00:ca:fe:ba:be:00  00:00:00:00:00:00  249                   202870
00:00:00:00:00:00  00:ca:fe:ba:be:00  249                   192659
00:00:00:00:00:00  00:00:00:00:00:00  496                   373114

The all-zeros MAC addresses are to indicate traffic direction (did I
mention this was legacy?), with all-zero-dst implying outbound, and
all-zero-src implying inbound.

I have messed around with the sample pool size and sampling rate fields in
my sFlow agent, to no avail - sfacctd still seems to only increment the
packet counter by one for each sample received. I half expected that
sfacctd would interpolate the flows, so that if I sent one flow sample from
a pool of 500, with sampling rate = 1, it would increment the packet
counter by 500. I assumed that this would be how sfacctd would correctly
accumulate packet counters for a real vendor-supplied sFlow agent, which
was sampling e.g. 1 out of 1000 packets.

We can live with byte counters only, since that is what we bill for, but it
would be nice to have packet counters too, so that we could calculate
average packet size (and spot high PPS sources).

What am I missing here?
pmacct-discussion mailing list

Reply via email to