Hi Daniel,

It seems you are looking to add the following yo your config:

sfacctd_renormalize: true


On Mon, Jun 12, 2017 at 03:39:30PM +0200, Daniel Swarbrick wrote:
> Hi,
> Firstly, thanks for the excellent community support on pmacct!
> I have a question regarding how sfacctd counts packets for sFlow sampled
> ethernet flows. I have written a simple sFlow agent in Python which is
> scraping counters from a legacy, procfs-based counter source, and faking
> sFlow sampled ethernet flows. I've diligently studied the sFlow spec, and
> the faked samples look totally fine in sflowtool and Wireshark. Feeding
> them to sfacctd is correctly counting the bytes, however the packet
> counters are only monotonically incremented for each sample received.
> The sfacctd.conf is about as simple as can be for now:
> plugins: memory
> aggregate: src_mac, dst_mac
> Dumping the in-memory counters:
> $ pmacct -s
> SRC_MAC            DST_MAC            PACKETS               BYTES
> 00:de:ad:be:ef:00  00:00:00:00:00:00  270                   219773
> 00:ca:fe:ba:be:00  00:00:00:00:00:00  249                   202870
> 00:00:00:00:00:00  00:ca:fe:ba:be:00  249                   192659
> 00:00:00:00:00:00  00:00:00:00:00:00  496                   373114
> The all-zeros MAC addresses are to indicate traffic direction (did I
> mention this was legacy?), with all-zero-dst implying outbound, and
> all-zero-src implying inbound.
> I have messed around with the sample pool size and sampling rate fields in
> my sFlow agent, to no avail - sfacctd still seems to only increment the
> packet counter by one for each sample received. I half expected that
> sfacctd would interpolate the flows, so that if I sent one flow sample from
> a pool of 500, with sampling rate = 1, it would increment the packet
> counter by 500. I assumed that this would be how sfacctd would correctly
> accumulate packet counters for a real vendor-supplied sFlow agent, which
> was sampling e.g. 1 out of 1000 packets.
> We can live with byte counters only, since that is what we bill for, but it
> would be nice to have packet counters too, so that we could calculate
> average packet size (and spot high PPS sources).
> What am I missing here?

> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists

pmacct-discussion mailing list

Reply via email to