Re: [c-nsp] nfSen / nfDump

2017-08-28 Thread Nick Hilliard
Nick Cutting wrote: > I didn’t seem to be able to use that command on a Nexus 9200 - the > guide for the shell seems for the 9500 and the 3k? N9K access instructions here: >

Re: [c-nsp] nfSen / nfDump

2017-08-28 Thread Nick Cutting
Thank you for your reply. Yes, I have a very similar config to yours below. Looks like I'll need to tell the noc to halve their findings. I didn’t seem to be able to use that command on a Nexus 9200 - the guide for the shell seems for the 9500 and the 3k? Thank you -Original Message-

Re: [c-nsp] nfSen / nfDump

2017-08-28 Thread Nick Hilliard
Nick Cutting wrote: > Doesn't look like sflow daemon supports the -s sampling tag. > > %sources = ( > 'myRouter' => { 'port' => '9901', 'col' => '#00ff00', 'type' => > 'netflow', 'optarg' => ' -s -1000 '}, > ); yes, that's correct. The sflow sampling rate is specified in each sflow

Re: [c-nsp] nfSen / nfDump

2017-08-28 Thread Nick Hilliard
Nick Cutting wrote: > sflow sampling-rate 4096 <-- this is 512? that means that out of every 4096 packets received on an interface, one will be punted to the sflow collector. You can check the hardware sampling rate using the PortSampRate command in the broadcom shell, like this: > n3k# test

Re: [c-nsp] nfSen / nfDump

2017-08-28 Thread Nick Cutting
This was an example I took from the nfsen forums - it is a negative value. -Original Message- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Justin M. Streiner Sent: Monday, August 28, 2017 3:32 PM To: cisco-nsp@puck.nether.net Subject: Re: [c-nsp] nfSen / nfDump

Re: [c-nsp] nfSen / nfDump

2017-08-28 Thread Justin M. Streiner
Wouldn't the syntax be "-s 1000", rather than "-s -1000"? jms On Mon, 28 Aug 2017, Nick Cutting wrote: So as usual - my netflow routers are coming up with the correct size data in nfsen, but sFlow is about 2.5 times as much traffic. Does anyone have a cisco sflow config that works with

Re: [c-nsp] nfSen / nfDump

2017-08-28 Thread Nick Cutting
So as usual - my netflow routers are coming up with the correct size data in nfsen, but sFlow is about 2.5 times as much traffic. Does anyone have a cisco sflow config that works with nfsen - sampling rate etc? sflow sampling-rate 4096 <-- this is 512? sflow max-sampled-size 128 sflow