Re: Questions about the sFlow plugin

From: Marc Lavine (mlavine@foundrynet.com)
Date: 03/24/03

  • Next message: Samuel: "Re: Questions about the sFlow plugin"

    Hello Samuel,

    Some versions of our sFlow agent code could improperly report the sampled packet
    sizes as 144 bytes. This seems to match up with the numbers you're observing
    (215.2 KB * 1024 / 1536 packets = ~144 bytes/packet). I think you'll need to
    get an updated version of the router software to correct this problem. Sorry
    for the glitch...

    Regards,
    Marc Lavine
    Foundry Networks, Inc.

    Samuel wrote:

    > Hello,
    >
    > I am trying to use nTop 2.1.56 to monitor the traffic over my network using
    > SFlow.
    > I use nTop has a collector for the S-Flow packets sent by my router.
    > Packet sampling rate is 1 per 512 packets.
    >
    > The nTop SFlow plugin should be correctly configured as the sFlow collector.
    >
    > But I get strange results:
    >
    > For instance, I tried to send a 1 GB file at 1 MB/s on the network. nTop
    > reports the following :
    > Stats / Throughput : Current / Peak ~ 2 Kbps
    > Total Data Sent : 1536 packets = 215.2 KB
    >
    > I don't understand those results, I was expecting to have:
    > total_size_sent * sampling_rate = total_size_received_by_ntop
    >
    > but actually we have here total_size_sent * sampling_rate = 2048 KB
    > which has nothing to do with total_size_received_by_ntop...
    >
    > But, if we assume an IP packet size is about 1448 bytes, then we have:
    > packets_sent = 1 GB / 1448 bytes
    >
    > and I observed indeed:
    > packet_sent * sampling_rate ~ packets_received_by_ntop
    >
    > So, why the size (and the speed) is wrong ?
    >
    > Does anyone here has managed to use ntop with sflow correctly ?
    > Thanks for your help...
    >
    > Samuel.



    This archive was generated by hypermail 2.1.4 : 03/24/03 PST