-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --On February 18, 2008 14:20:42 +0000 Maurizio Molina <[EMAIL PROTECTED]>
wrote:
| Peter Haag wrote:
| > Hi Maurizio
| >
| > --On February 18, 2008 10:48:07 +0000 Maurizio Molina <[EMAIL PROTECTED]>
wrote:
| >
| > | Hi,
| > | I'm using nfsen snapshot-20070312 and nfdump snpsht-20070312
| > |
| > | I frequently (say every few hours) see short periods (15-20') in which
| > | traffic from some routers drops almost to zero. Before investigating if
| > | something is wrong with the router or the communication channel with the
| > | collector, I think it's better to see if nfcapd is not loosing packets.
| > | I see that in nfsen.conf there's this conf parameter
| > |
| > | # Receive buffer size for nfcapd - see man page nfcapd(1)
| > | $BUFFLEN = 200000;
| > |
| > | -B bufflen
| > | Specifies the socket input buffer length in bytes. For high volume
| > | traffic ( near GB traffic ) it is recommended to set this value as
| > | high as possible ( typically > 100k ), otherwise you risk to lose
| > | packets. The default is OS (and kernel ) dependent.
| > |
| > | according to the above, I've set it to a safe value. The Netflow stream
| > | into my collector averages at 1-2 Mbit/s (but I don't know about peaks,
| > | they might actually be high, as the channels between the routers and the
| > | collectors are mostly Gbit/s ones...).
| >
| > Generally, you are safe with the defaults provided. The default buffer
should
| > be big enough. 1-2 MB/s is absolute no problem for nfcapd. The buffer is
mostly
| > provided to cope with high peeks, at which the route may export the flows.
| >
| > |
| > | So:
| > | 1) should I try some other value?
| >
| > No - increasing this buff even more does not improve more.
| >
| > | 2) if I do loose packets because of this buffer issue, would tehre be
| > | messages in the nfsen logs? which ones?
| >
| > Loosing packets may occur anywhere in the chain from the exporter to the
collector.
| > nfcapd reports sequence failures via syslog, which covers all missing
packets.
| Hi Peter,
| I'm seeing occasionally messages like the following one in
| /var/log/messages:
| Feb 18 10:50:01 srv3 /opt/flowtest/tools/nfdump/1.5/bin/nfcapd[20858]:
| Ident: 'ath_gr' Flows: 121413, Packets: 188322, Bytes: 129264757,
| Sequence Errors: 1, Bad Packets: 0
Yes.
- Peter
|
| Is it that what you were referring too?
| thanks,
| MAurizio
| >
| > - Peter
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Microsoft
| Defy all challenges. Microsoft(R) Visual Studio 2008.
| http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBR7mZrf5AbZRALNr/AQLlSQP/YZjI2dXv93UlLjK05Q0B2faiZUFs7Wa5
4G4JJnD0JsX4I9tNjK229DQBVOBkhbmJE5vrE4afq5amsTJ3LHLvpAtDFDLnC8r+
cCzuMjKRDr1RF3Az1VKk8zn5thVdroBZUU4k1VC5pXguQfpCdOhv7sBGwX23/Aft
wWo2PYUsHQ4=
=iSt1
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
