Problems migrating from netflow to sFlow: results are low

From: Christian Hammers <ch@westend.com>
Date: 08/10/05
Message-ID: <20050810144132.GK9687@westend.com>

Hello

I hope this is an appropriate mailing list to get some hints why my
attempts to migrate from netflow to sflow are currently failing because
the sflow data is just too "less" (I expected about 0-10% differenc).

    +------------+-------------+---------------+----------+------------+------+
    | day | sflow_flows | netflow_flows | sflow_mb | netflow_mb | s/n |
    +------------+-------------+---------------+----------+------------+------+
 Sa | 2005-08-06 | 2927 | 6128 | 513.223 | 961.606 | 0.53 |
 So | 2005-08-07 | 3060 | 6652 | 557.467 | 1659.690 | 0.34 |
 Mo | 2005-08-08 | 3240 | 6597 | 588.296 | 795.497 | 0.74 |
 Di | 2005-08-09 | 3212 | 6663 | 563.515 | 1525.798 | 0.37 |
    +------------+-------------+---------------+----------+------------+------+

The test data below compares the volumina of some ADSL customers who
could easily be identified by their network adresses (netflow) and
are all behind one switchport which is exported via sflow. Their
incoming data is exported via netflow *not* by this switch but by the
router before it.

The sFlow packets are collected and converted to netflow via:
        "sflowtool -c localhost -d 2042"
The netflow packets are then collected and written to a MySQL database by
the same program that collects our normal netflow data.

I already verified that the number of packets going in and out of the Ethernet
interface is the ca. "samplerate * sample_collected" and also ca. the number
of netflow entries in my database. So there's no significant packet loss due
to a too high number of samples arriving the collector etc.
The number of exported UDP packets in a given timestamp is also about 20/min as
configured.

The switch has the following configuration:
        telnet@foundry-switch# show sflow
        sFlow services are enabled.
        sFlow agent IP address: 192.168.230.191
        Collector IP 192.168.230.7, UDP 6343
        Polling interval is 20 seconds.
        Configured default sampling rate: 1 per 512 packets.
        Actual default sampling rate: 1 per 512 packets.
        49240976 UDP packets exported
        305332506 sFlow samples collected.
        sFlow ports: ethe 3
        Port Sampling Rates
        -------------------
        Port=3, configured rate=512, actual rate=512

Any ideas? Is sflowtool recommended for production usage?

bye,

-christian-

-- 
Christian Hammers             WESTEND GmbH  |  Internet-Business-Provider
Technik                       CISCO Systems Partner - Authorized Reseller
                              L|tticher Stra_e 10      Tel 0241/701333-11
ch@westend.com                D-52064 Aachen              Fax 0241/911879
Received on Wed Aug 10 07:48:38 2005

This archive was generated by hypermail 2.1.8 : 08/10/05 PDT