Hmm, if the source machine doesn't have enough resources to export the
flows, you should see things like - a core being used 100% by fprobe or udp
packets being dropped because of too small buffers in the output of netstat
-s (check on both source and destination). You could use iptables to count
packets leaving the source vs packets arriving at the destination to rule
out network drops in between with something like
iptables -A OUTPUT -m udp --dport 9995 -j ACCEPT
iptables -A INPUT -m udp --dport 9995 -j ACCEPT
And check stats with
iptables -l -n -v
But it's difficult to troubleshoot...
On 4 Dec 2015 15:09, "Leandro" <[email protected]> wrote:
> Adrian , thanks for your response.
> About sampling ... Im not sure what is it but im running the fprobe just
> with the line:
>
> /usr/local/sbin/fprobe -i eth3 -fip -n7 172.24.3.12:9995
>
> Which in a case o a traffic bellow than 1gbps works great.
> In my case the message you are describing "Sequence errors or bad packets"
> Apears many times in the collector log file, so there is some problem ,but;
> How can I confirm if the problem is on the nfcapd or the fprobe side ? Can
> I modify on something on any side to properly export more than 1.4Gbps ?
> Both machine where they are running are very powerfull machines.
>
> I can provide more info
> Thanks in advance!!!
> Leo.
>
>
> On 04/12/15 04:37, Adrian Popa wrote:
>
> If you're using sampling you should see differences between netflow
> traffic and real traffic. If not, check that:
>
> 1. you're not losing UDP packets - if you lose packets you should see
> something like this:
> Dec 4 09:35:00 localhost nfcapd[13268]: Ident: 'MyRouter' Flows: 11763,
> Packets: 930064, Bytes: 731126982, Sequence Errors: 0, Bad Packets: 0
>
> Sequence errors or bad packets will indicate something's wrong on the
> network side.
>
> 2. your router has enough capacity (TCAM memory) to export all the flows
> If you get errors in your router's log that TCAM memory is nearly
> exhausted, then the router will stop producing flows for a while and you
> get those drops at higher traffic.
>
>
> On Thu, Dec 3, 2015 at 9:48 PM, Leandro <[email protected]> wrote:
>
>> Hi , guys.
>> It is very strange but , my nfsen is showing a maximun traffic value of
>> 1.2 gbps when the traffic showed on cacti is 2gbps(also meassured on the
>> router).
>> Traffic shape is ok , minimun values mathes on both tools.
>> Any ideas about it ? Is there something to tune on fprobe, nfcapd or
>> nfsen ?
>>
>> Regards,
>> Leandro.
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Go from Idea to Many App Stores Faster with Intel(R) XDK
>> Give your users amazing mobile app experiences with Intel(R) XDK.
>> Use one codebase in this all-in-one HTML5 development environment.
>> Design, debug & build mobile apps & 2D/3D high-impact games for multiple
>> OSs.
>> http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
>> _______________________________________________
>> Nfsen-discuss mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>>
>
>
>
------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
