I just started messing with sflow and jflow (netflow?) and I have what seems to be a question back to 2005'ish. How to get ntop to .... multiply / scale the packet info received from a sampling device using sflow / jflow / whatever such that the displayed data reflects something as close to real world as possible.
I don't want to get into a debate about if sampling is "accurate" and what not. What I do want to solve is: if ntop only sees 1 of n packets (or flow record has 1 of n packets), what does ntop do with it? Obviously if ntop doesn't account for the sampling somehow, ntop reports will be off my apx. R, where R is the sampling rate; such as 100, 1000, etc. This is not good. But, can ntop simply multiply some (all?) values in the *flows by R? Any thoughts on this would be great. I know a particular person with initials RJ that's been playing with sflow and rrd, perhaps he has some insight? G <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
