I withdraw the below. My assumption is wrong, i made another profile where the sources are separated and the graph is still buggy.
So next guess is interaction between "yaf" and "nfcapd" or "yaf". As the support for "yaf" is a bit experimental and was realized in private emails with peter I guess it's the first. I will switch for some time to "pmacctd" for the conversion from SPAN to flow and report back. Am 06.07.2018 um 12:32 schrieb Jens Hektor: > I have here somewhat "buggy" graphs in my nfsen setup. > > Summary: > It looks like "+" or "-" in the channels is inverted > for my 2nd source for at least my traffic graphs. > > My setup: we have two internet uplinks on two routers > > Data are sent via SPAN port to some machine where > yaf 2.10 converts this into ipfix flows sent to two > different ports on my nfsen machine. > > So I have both routers separated and hence two channels > in the live profile, one for each router. > > I have setup a different profile that is fed from these data > where I make nice graphs separating these into outgoing (sign: +) > and incoming (sign: -) for several network groups (aka: user groups). > > So in this profile I have always pairs of channels > that a have a filter expression with some of our networks either as source > (outgoing) or as destination (incoming). > > What it looks like is that the sign is correct for this > first source but inverted for the second. > > In the flow graphs this is not obvious (or maybe not even present) > but it seems to affect pakets and obviously the graphed traffic. > > I can compare that with our weathermap here with stats made from SNMP. > > So my question: has anyone observed this? Or @Peter: any idea? -- Dipl.-Phys. Jens Hektor, Networks IT Center, RWTH Aachen University Room 2.04, Wendlingweg 10, 52074 Aachen (Germany) Phone: +49 241 80 29206 - Fax: +49 241 80 22100 http://www.itc.rwth-aachen.de - [email protected]
smime.p7s
Description: S/MIME Cryptographic Signature
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
