Re: Re: sFlow parsing...

Hi Neil

Thanks for that, that was very informative.

Regards
Mandip

----- Original Message -----
From: "neil mckee" <neil.mckee@inmon.com>
To: <sflow@sflow.org>
Sent: Monday, November 27, 2006 8:38 PM
Subject: [sFlow] Re: sFlow parsing...

> Hello Mandip,
>
> Actually you don't need anything from the counter-samples in order to
> scale the flow-samples correctly. This question has come up before
> on the mailing list. It is covered in some detail by the paper
> "Packet Sampling Basics" here:
> http://www.sflow.org/packetSamplingBasics/index.htm
>
> ...but essentially all you need to do is accumulate successive
> increases in the "sample_pool" variable, and use that to infer the
> effective sampling ratio for that data-source, over the time interval
> of your choice:
>
> effective_sampling_ratio = delta(sample_pool) / samples_received
> frames(X) = samples_received(X) * effective_sampling_ratio
>
> where:
> * - sample_pool is a counter in the flow-sample header (see spec
> for details)
> * - samples_received is the number of samples that were
> successfully received at the collector
> * - frames(X) is the number of samples that fall into a particular
> category, such as being from a particular source IP address
>
> example
> =======
> So let's imagine that a particular data-source has been configured to
> sample at 1-in-512, and you received 100 flow-samples in 1 minute,
> and between the first sample and the last sample the samplePool
> increased from, say, 120,332 to 172,332 (an increase of 52,000), and
> of those 100 samples, 50 were from the IP source address 10.2.3.4:
>
> effective_sampling_ratio = 52000 / 100 = 520
> frames(10.2.3.4) = 50 * 520 = 26,000
>
> Notes:
> 1. If you do it this way, then it's OK for some sFlow packets to be
> lost (just changes the effective sampling ratio).
> 2. The sample-pool counter will wrap, and may occasionally be reset
> to 0, so treat it the same way as you would treat any other 32-bit
> counter.
> 3. To get from frames to bytes, you can multiply by the average
> packet size (as computed from the received samples).
>
> Hope this helps,
> neil
>
>
> ----
> Neil McKee
> InMon Corp.
> http://www.inmon.com
Received on Tue Nov 28 04:10:12 2006