From: Neil McKee (email@example.com)
What tool are you using to receive the sFlow packets and
report the results?
Multiplying by the configured sampling rate is only an
approximate way to scale up the results. The correct way to
do it is to multiply by the delta in the samplePool variable
divided by the number of samples. That way you will not be
affected by packet loss in transit or pseudo-random bias in
the random number generator.
For details, see the equations in "Packet Sampling Basics" on
the sflow.org website.
The poller is not very flexible. It prefers to poll at
intervals < 60 seconds.
The delta TOO BIG message is caused by a counter counting
backwards on your device - seems to happen a lot on Cisco boxes.
The wierd numbers for samplingRate = 0 or 1 might be caused by
packets being dropped somewhere in the system. This code is
not optimised for looking at every packet. It expects to be
The text files are not really needed for what you are doing.
When you say "nProbe" do you mean "NTop Probe"?
Perhaps the most important aspect of our probe software is
that it records the input and output ports on the
switch/router for each sample. This means you can effectively
monitor all the ports on the switch. It's like having a
separate probe on each port.
Wanja Jansson wrote:
> Hi again,
> Thank for the help the other time. Now I have a new problem:
> I am doing a comparison with the sFLowSP and a nProbe, by
> a big file (a movie on about 800MB) from one computer to
> I get some very strange results. I think it has to do with
> parameters in the configuration files. I am reading in the
> but can still don't figure out what the parameters do.
> CONFIGURATION FILE:
> My configuration file looks like this: Should I change
> What does debug=0 means? And where should I find the .txt
> Do I need them?
> ErrorLog = inxPKP.err
> TraceLog = inxPKP.log
> Command = inxPKP.cmd
> #include "./inxGlobal.ini"
> MIBInterval = 10
> ; ================= settings ================
> PKPDevice = eth0
> PKPDriverSampling = NO
> PKPDeviceEnabled = YES
> PKPsFlowEnabled = YES
> PKPAgent = 10.1.1.15
> PKPCommunity = public
> PKPSamplingRate = 1000
> PKPCollectorHost = 10.1.2.53
> PKPMirrorDirection = both
> PKPPollInterval = 45
> PKPPromiscuous = YES
> PKPMPRefreshTimeout = 3600
> PKPMPRequestTimeout = 2
> PKPMPSuppressRetryTimeout = 3600
> PKPMPTableSize = 49999
> PKPMPBridgeTable = bridgeTable.txt
> PKPMIBIIRouteTable = routingTable.txt
> PKPASInterfaceTable = ifTable.txt
> PKPASPortMapping = YES
> PKPASSymmetric = YES
> PKPVLANTable = vlanTable.txt
> ; now include a config file for optionally overriding these
> ; and others below (from global.ini and inxGlobal.ini)
> #includeWithNoComments "/var/sFlowSP/config/pkp.ini"
> PidFile = ../pids/inxPKP.pid
> debug = 0
> Further below in the example logfile I havn't change anything.
> LOG FILE:
> What is a "good" Pollinterval? When I try e.g 60, the log
> 20021120132335: pollCounters: WARNING: poll interval is >
> What is activeinterval?
> Other lines in the log file use to look like this:
> 20021120003546: pollCounters: in_multicasts
delta32=4294967295 TOO BIG -
> not accumulating (old=91764, new=91763)
> 20021120003738: portLookup: concurrent SNMP requests at
> sending another
> 20021120084911: pollCounters: 10.1.1.15:4 out_bytes changed
from 0 to
> 3310411095 - not accumulating
> What does these different lines means? Is something wrong?
> For example, the "PKPSamplingRate": when I set PKPSamplingRate = 0,
> the sampling should be disabled and with PKPSamplingRate =1
> should be sampled. Am I right? And in that case, what is
the output I get
> with PKPSamplingRate = 0 and 1?
> Below are the result of one of my test of sending a movie
> With samplingrate 0 and 1 the results are completely
> With samplingrate 10, 100, 1000 and 10000 I get more or
less the correct
> of bytes IF I multilpy the total sum of bytes with the
> Is it really supposed to be like that?
> Is there anywhere some documents except from the RFC 3176
> sFlow Sampling Rate = 0
> Total: 103768
> sFlow Sampling Rate = 1
> Total: 99742
> sFlow Sampling Rate = 10
> Total: 58811
> sFlow Sampling Rate = 100
> Total: 5829
> sFlow Sampling Rate = 1000
> Total: 574
> sFlow Sampling Rate = 10000
> Total: 58
> Thanks again,
> Free email with personality! Over 200 domains!
-- Neil McKee, InMon Corp. tel: +1 (415) 661-6343 http://www.inmon.com
This archive was generated by hypermail 2.1.4 : 11/21/02 PST