The bottom of the flow-xlate manpage states (in the BUGS section): "The scale option can overflow the 32 bit flow counters. This could be solved by detecting this condition and splitting the flow in two."
Does anybody on the list know of any patches that implement the proposed solution above? With 1:100 sampling and 60 second active flow timeout, in combination with a 'scale 100' xlate-action, a single flow over 4GB inside the 60 second period causes the counter to overflow (e.g. send ~600Mbps for 60 sec, ~1200Mbps for 30 sec, etc) For example, sending 1200Mbps for 30 seconds will generate > 4GB in a single flow and cause an overflow: % bwctl -c 10.1.1.2 -t 30 -x -u -b 1200M ... [ ID] Interval Transfer Bandwidth [ 9] 0.0-30.0 sec 4899999510 Bytes 1306666275 bits/sec [ 9] Sent 3333333 datagrams At the ingress router: 0323.13:01:26.872 0323.13:01:29.977 171 10.0.0.1 5026 120 10.1.1.2 5026 17 0 312,800 457,939,200 0323.13:01:29.927 0323.13:01:57.163 171 10.0.0.1 5026 120 10.1.1.2 5026 17 0 2,680,500 3,924,252,000 At the egress router: 0323.13:01:27.124 0323.13:01:57.125 122 10.0.0.1 5026 172 10.1.1.2 5026 17 0 2,991,600 84,735,104 At the ingress router, the flow was broken up into 2 flows because the first portion of the flow was exported before the end of the 30 second test. However, we were not so lucky on the egress router. The packet counts are correct (all of the packets in this test were 1470 byte UDP packets), but clearly the bytes counter overflowed. Thanks, -Chris _______________________________________________ Flow-tools mailing list [email protected] http://mailman.splintered.net/mailman/listinfo/flow-tools
