Hi, Firstly, thanks for the excellent community support on pmacct!
I have a question regarding how sfacctd counts packets for sFlow sampled ethernet flows. I have written a simple sFlow agent in Python which is scraping counters from a legacy, procfs-based counter source, and faking sFlow sampled ethernet flows. I've diligently studied the sFlow spec, and the faked samples look totally fine in sflowtool and Wireshark. Feeding them to sfacctd is correctly counting the bytes, however the packet counters are only monotonically incremented for each sample received. The sfacctd.conf is about as simple as can be for now: plugins: memory aggregate: src_mac, dst_mac Dumping the in-memory counters: $ pmacct -s SRC_MAC DST_MAC PACKETS BYTES 00:de:ad:be:ef:00 00:00:00:00:00:00 270 219773 00:ca:fe:ba:be:00 00:00:00:00:00:00 249 202870 00:00:00:00:00:00 00:ca:fe:ba:be:00 249 192659 00:00:00:00:00:00 00:00:00:00:00:00 496 373114 The all-zeros MAC addresses are to indicate traffic direction (did I mention this was legacy?), with all-zero-dst implying outbound, and all-zero-src implying inbound. I have messed around with the sample pool size and sampling rate fields in my sFlow agent, to no avail - sfacctd still seems to only increment the packet counter by one for each sample received. I half expected that sfacctd would interpolate the flows, so that if I sent one flow sample from a pool of 500, with sampling rate = 1, it would increment the packet counter by 500. I assumed that this would be how sfacctd would correctly accumulate packet counters for a real vendor-supplied sFlow agent, which was sampling e.g. 1 out of 1000 packets. We can live with byte counters only, since that is what we bill for, but it would be nice to have packet counters too, so that we could calculate average packet size (and spot high PPS sources). What am I missing here?
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
