Adrian, finally I got it working properly.
Reading the man page for fprobe I founded the following:
Reasonable configuration to run under heavy load:
fprobe -fip -B4096 -r2 -q10000 -t10000:10000000 localhost:2055
After applying the B , r and q parameters I got the complete traffic shape.
Also at fprobe server , any performance parameter showed some increment
so I think it is working
Thanks for your advice.
Leandro.
On 05/12/15 04:28, Adrian Popa wrote:
Hmm, if the source machine doesn't have enough resources to export the
flows, you should see things like - a core being used 100% by fprobe
or udp packets being dropped because of too small buffers in the
output of netstat -s (check on both source and destination). You could
use iptables to count packets leaving the source vs packets arriving
at the destination to rule out network drops in between with something
like
iptables -A OUTPUT -m udp --dport 9995 -j ACCEPT
iptables -A INPUT -m udp --dport 9995 -j ACCEPT
And check stats with
iptables -l -n -v
But it's difficult to troubleshoot...
On 4 Dec 2015 15:09, "Leandro" <[email protected]
<mailto:[email protected]>> wrote:
Adrian , thanks for your response.
About sampling ... Im not sure what is it but im running the
fprobe just with the line:
/usr/local/sbin/fprobe -i eth3 -fip -n7 172.24.3.12:9995
<http://172.24.3.12:9995>
Which in a case o a traffic bellow than 1gbps works great.
In my case the message you are describing "Sequence errors or bad
packets"
Apears many times in the collector log file, so there is some
problem ,but;
How can I confirm if the problem is on the nfcapd or the fprobe
side ? Can I modify on something on any side to properly export
more than 1.4Gbps ?
Both machine where they are running are very powerfull machines.
I can provide more info
Thanks in advance!!!
Leo.
On 04/12/15 04:37, Adrian Popa wrote:
If you're using sampling you should see differences between
netflow traffic and real traffic. If not, check that:
1. you're not losing UDP packets - if you lose packets you should
see something like this:
Dec 4 09:35:00 localhost nfcapd[13268]: Ident: 'MyRouter' Flows:
11763, Packets: 930064, Bytes: 731126982, Sequence Errors: 0, Bad
Packets: 0
Sequence errors or bad packets will indicate something's wrong on
the network side.
2. your router has enough capacity (TCAM memory) to export all
the flows
If you get errors in your router's log that TCAM memory is nearly
exhausted, then the router will stop producing flows for a while
and you get those drops at higher traffic.
On Thu, Dec 3, 2015 at 9:48 PM, Leandro <[email protected]
<mailto:[email protected]>> wrote:
Hi , guys.
It is very strange but , my nfsen is showing a maximun
traffic value of
1.2 gbps when the traffic showed on cacti is 2gbps(also
meassured on the
router).
Traffic shape is ok , minimun values mathes on both tools.
Any ideas about it ? Is there something to tune on fprobe,
nfcapd or
nfsen ?
Regards,
Leandro.
------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development
environment.
Design, debug & build mobile apps & 2D/3D high-impact games
for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140
_______________________________________________
Nfsen-discuss mailing list
[email protected]
<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
------------------------------------------------------------------------------
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
