Re: Sample's sequence number

Hello Bao,

On Mar 15, 2005, at 4:43 AM, Bao wrote:

> Hi everyone,
>
>
> For example, we have one of our border routers connected to a peering
> point at London (Linx) via our Gigabit port 2/3 (IfIndex : 67).
> I would like to analyze the in/out traffic of this port via sFlow.
>
> As Neil McKee suggested, the right algorithm for estimating the frames
> from a source X is :
>
> effective_sampling_rate = delta(sample_pool) / samples_received
> frames(X) = samples_received(X) * effective_sampling_rate
>
> Now, in order to get the samples_received, I try to use the sample's
> sequence number, making the difference between the current sequence
> number and the last value of it.
>

Actually the samples_received value should be the number of samples
that you really did receive. In other words, just count them one at
a time as they come in.

> We know that the sample sequence number is a 32bits counter which is
> incremented with each flow sample generated by a designated source_id.
>
> But the problem is, when I look at the lower 3 bits of the source_id
> (unsigned int), I see that it always gets the same value as the "input
> port" field so, for example, I can determine how much traffic is
> coming in through this port 67 (IfIndex). How can I do to determine
> how much traffic is going out through this same port 67 ? Do I have to
> calculate it by using the "sample rate" field ?
>

It sounds like your router is only sampling inbound packets (that's
quite common). To estimate outbound traffic on interface 67 you need
to enable sFlow on all interfaces, and then look at all the samples
whose output_port was ifIndex 67. Of course the other source_ids will
have different values for sample_pool and samples_received (and may
even have different sampling rates) so you need to scale those
estimates separately before you combine them.

regards,
neil

> --
> Bao
>
>
----------
Neil McKee
http://www.inmon.com
Received on Tue Mar 15 08:16:14 2005