Hi, I'm using nfsen snapshot-20070312 and nfdump snpsht-20070312 I frequently (say every few hours) see short periods (15-20') in which traffic from some routers drops almost to zero. Before investigating if something is wrong with the router or the communication channel with the collector, I think it's better to see if nfcapd is not loosing packets. I see that in nfsen.conf there's this conf parameter
# Receive buffer size for nfcapd - see man page nfcapd(1) $BUFFLEN = 200000; -B bufflen Specifies the socket input buffer length in bytes. For high volume traffic ( near GB traffic ) it is recommended to set this value as high as possible ( typically > 100k ), otherwise you risk to lose packets. The default is OS (and kernel ) dependent. according to the above, I've set it to a safe value. The Netflow stream into my collector averages at 1-2 Mbit/s (but I don't know about peaks, they might actually be high, as the channels between the routers and the collectors are mostly Gbit/s ones...). So: 1) should I try some other value? 2) if I do loose packets because of this buffer issue, would tehre be messages in the nfsen logs? which ones? Thanks, Maurizio -- ______________________________________________________________________ Maurizio Molina Network Engineer DANTE - www.dante.net Tel: +44 (0)1223 371 300 Fax: +44 (0)1223 371 371 Email: [EMAIL PROTECTED] PGP Key ID: 3FF58D51 City House, 126-130 Hills Road Cambridge CB2 1PQ UK _____________________________________________________________________ ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
