Hi, a bit more details on what puzzles me. It's not true (as I said in a previous mail) that the number of aggregated flows is always limited to 10. It is limited to 10 if I look at a 5 minutes time interval, but then it increases with the interval duration. Look at the example below. It's probably a persisting ssh connection between two hosts. Both the number of packets and the number of flows increase (almost linearly) with the interval duration. Why I'm not happy? because this behavior would be consistent with an active timeout of 30 seconds (so, if a flow is persistent, it would be exported, roughly, 10 times every 5 minutes). But the active timeout in my routers is 300 sec!!, so I would expect to see a persistent flow to be exported, at most, 1 time every 5 minutes. Also, it cannot be due to the inactive timeout (which in my routers is 60 s).
Any hint? CAn anybody check, by identifying a persistent flow their network, if they observe a behavior consistent with their active timeout? Date flow start Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows 5 min slot 2007-07-26 22:19:46.432 270.910 TCP x.138.4.19:22 -> y.220.165.210:48117 580 806816 10 10 min slot 2007-07-26 22:19:46.432 571.423 TCP x.138.4.19:22 -> y.220.165.210:48117 1013 1410084 20 15 min slot 2007-07-26 22:19:46.432 814.342 TCP x.138.4.19:22 -> y.220.165.210:48117 1469 2048588 28 20 min slot 2007-07-26 22:19:46.432 1160.044 TCP x.138.4.19:22 -> y.220.165.210:48117 2099 2935420 35 ...... 60 min slot 2007-07-26 22:19:46.432 3521.209 TCP x.138.4.19:22 -> y.220.165.210:48117 6048 8441088 112 ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
