From: Peter Phaal (peter.phaal@inmon.com)
Date: 11/13/02
Wanja,
The difference is in the way the sFlow probe and the ntop probe operate:
The sFlow probe operates as a proxy for an sFlow agent embedded within the
switch it is monitoring. When it exports sFlow data it marks the source as
being the switch and it dynamically interrogates the switch in order to map
packets to switch input/output ifIndexes, vlans, subnets, bgp as-paths etc.
This data is virtually identical to that you would get from an embedded
sFlow/NetFlow agent in the switch.
The ntop probe operates as a traditional probe. It reports on the packets it
sees through a promiscuous interface. The netflow packets are marked as
originating from the probe and the ifIndex information is not included
(since packets don't actually flow through the probe).
Peter
> Then the data
> from the ntop probe is shown in one big table without any
> ifindex while the
> data from the sFlow Probe is divided on 7 different tables,
> one for each
> ifindex (ifindex 1,2,6,10,14,18 and 26)
>
> I would like to get the data from the two probes shown
> similar, so I have a
> chance to campare the both results. And see if there is a
> difference to
> sample the data or not.
>
> Does anyone know this problem an knows how I can get around
> it? Where can
> the problem with the ifindexes be? I mean, does it depend on Cflowd,
> arts++, the sflowtool or the probes?
This archive was generated by hypermail 2.1.4 : 11/13/02 PST