Hi Marc, I would ask you if you can send me privately a packet capture (in tcpdump format, full payload) so that i can have a look into it and possibly replay in lab.
This should very well give an insight on the sequence jumps; and might also give an hint why not all the traffic is accounted for ie. if there is a cause-effect relationship between the twos. Let me know if this is acceptable to you. Cheers, Paolo On Thu, Jan 14, 2010 at 02:54:55PM -0800, marc slice wrote: > They appear frequently. Every 10-15 secs. We have between 25-80Mbps running > across the interfaces recording netflow data on the enterasys through out the > day. Not all the traffic is getting recorded when compared to port > statistics. No real pattern that we have found. We have 1Gbps connections > from the enterasys to the collector and the collector is a HP 2 CPU opteron > box with 8GB of memory. CPU is seeing very little use at all times. > > > > ----- Original Message ---- > From: Paolo Lucente <pa...@pmacct.net> > To: pmacct-discussion@pmacct.net > Sent: Wed, January 13, 2010 3:33:36 PM > Subject: Re: [pmacct-discussion] Enterasys nfacctd expecting flow error > > Hi Marc, > > Such messages tell it has been detected some issues with > NetFlow datagram sequence numbers. This can be caused by > packet loss between an agent and the collector, mistakes > in the sequencing encoding among the others. Besides the > warning messages, which can be turned off, NetFlow datagrams > reaching pmacct are processed as usual. > > Do you see such messages appearing regularly or occasionally? > Can you spot a pattern (ie. only a subset of the devices > are affected, jumps repeat the same way, etc.)? > > Cheers, > Paolo > > On Wed, Jan 13, 2010 at 11:52:07AM -0800, marc slice wrote: > > I have setup netflow from an Enterasys N series switch and receive the > > following when running nfacctd. > > > > WARN: expecting flow '2727940030' but received '2727940026' > > collector=0.0.0.0:2055 agent=172.16.32.2:513 > > WARN: expecting flow '11226450' but received '11226438' > > collector=0.0.0.0:2055 agent=172.16.32.2:769 > > WARN: expecting flow '2727940052' but received '2727940056' > > collector=0.0.0.0:2055 agent=172.16.32.2:513 > > WARN: expecting flow '11226456' but received '11226468' > > collector=0.0.0.0:2055 agent=172.16.32.2:769 > > WARN: expecting flow '2727952866' but received '2727952852' > > collector=0.0.0.0:2055 agent=172.16.32.2:513 > > WARN: expecting flow '11226618' but received '11226617' > > collector=0.0.0.0:2055 agent=172.16.32.2:769 > > WARN: expecting flow '2727952868' but received '2727952882' > > collector=0.0.0.0:2055 agent=172.16.32.2:513 > > > > Couldn't find much info on this problem and was wondering if someone could > > help? > > > > [ ... ] > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > > > > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
