-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
As for the collector: Have a look into the daemon syslog log file. The
collector reports every 5min
the number of sequence errors and bad packets.
- Peter
- --On February 19, 2007 20:00:05 -0800 Max Clark <[EMAIL PROTECTED]> wrote:
| Hi all,
|
| I installed and configured nfsen quite some time ago on a FreeBSD box
| (nfsen-1.2.4.20060412) I haven't really had the time to look at it
| since and now that we have some significant traffic to analyze things
| are not looking right (to clarify the nfcapd process is running, the
| web interface works, rrds update, etc...). Before I go to far all ip
| flow/mls configuration is below (and I have added "ip route-cache
| flow" to all of our interfaces to transit networks):
|
| ip flow-cache entries 131072
| ip flow-cache timeout active 5
| mls rp ip
| mls ip multicast flow-stat-timer 9
| mls aging fast time 30 threshold 64
| mls aging long 900
| mls aging normal 32
| no mls netflow
| mls flow ip interface-full
| no mls flow ipv6
| mls nde sender version 5
| no mls acl tcam share-global
| mls cef error action freeze
|
| ip flow-export source Loopback0
| ip flow-export version 5 origin-as
| ip flow-export destination x.x.x.x 9995
|
| I'm convinced that something is configured wrong because almost 2 Gbit
| of IP Traffic equates to these sized files on the nfsen box (see
| below) and when I look at the Packets/s graph it is reporting in the
| hundreds when I know on interface is pushing over 200k.
|
| -rw-r--r-- 1 www www 343K Feb 20 03:05 nfcapd.200702200300
| -rw-r--r-- 1 www www 319K Feb 20 03:10 nfcapd.200702200305
| -rw-r--r-- 1 www www 326K Feb 20 03:15 nfcapd.200702200310
| -rw-r--r-- 1 www www 345K Feb 20 03:20 nfcapd.200702200315
|
| What should I be looking at to troubleshoot/fix this?
|
| Thanks in advance,
| Max
|
| p.s. I'm running 122-18.SXF3 on a Cisco 6509 w/ a Sup 720 3BXL
|
| Cisco Internetwork Operating System Software IOS (tm) s72033_rp
| Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(18)SXF3,
| RELEASE SOFT)
|
| --
| Max Clark
| http://www.clarksys.com
|
| -------------------------------------------------------------------------
| Take Surveys. Earn Cash. Influence the Future of IT
| Join SourceForge.net's Techsay panel and you'll get the chance to share your
| opinions on IT & business topics through brief surveys-and earn cash
| http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRdqjZP5AbZRALNr/AQIdBQP/S8orUYTd7ArXQ5A1manzjiIry5qdRveA
SvNMlKUoSA6J1R+5hIXkllwUNqvu1Z/MzsG1NsaKbHQPFeBk4LvgrxUiXPYDE46h
+ggSLkys80JZ+kbRiR6yI2iS4/s+GR2rHR2hJByM6WFK8DNAn2K1IKwXqkWPv/yD
DsKGFyWpXS8=
=nDzy
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
