Thank you for your reply. Yes, I have a very similar config to yours below.
Looks like I'll need to tell the noc to halve their findings. I didn’t seem to be able to use that command on a Nexus 9200 - the guide for the shell seems for the 9500 and the 3k? Thank you -----Original Message----- From: Nick Hilliard [mailto:n...@foobar.org] Sent: Monday, August 28, 2017 5:13 PM To: Nick Cutting <ncutt...@edgetg.com> Cc: cisco-nsp@puck.nether.net Subject: Re: [c-nsp] nfSen / nfDump This message originated from outside your organization Nick Cutting wrote: > Doesn't look like sflow daemon supports the -s sampling tag. > > %sources = ( > 'myRouter' => { 'port' => '9901', 'col' => '#00ff00', 'type' => > 'netflow', 'optarg' => ' -s -1000 '}, ); yes, that's correct. The sflow sampling rate is specified in each sflow packet, so there is no need to specify it on the collector - it's automatically detected on a per-packet basis. This is a working config on a small site (albeit a different sflow agent platform, but that won't make any difference): > %sources = ( > 'rtr01' => { 'port' => '2055', 'col' => '#0000ff', 'type' => 'sflow' > }, > 'rtr02' => { 'port' => '2056', 'col' => '#00ff00', 'type' => > 'sflow' }, ); nfsen will then start up sfcapd instead of nfcapd. Nick _______________________________________________ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/