All you're showing are COUNTERSAMPLE samples. Are there anything else in there?
As I quoted from the FAQ: "COUNTERSAMPLE packets give a quick look at interface counters on the machine, whereas FLOWSAMPLE packets are actual packet fragments from IP connections. Ntop seems to simply parse, debug_print, and discard COUNTERSAMPLE packets..." -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, March 29, 2005 10:22 AM To: [email protected] Cc: [email protected] Subject: RE: [Ntop] sFlow not working! This IP/MASK is the one of my Network Foundry switch -> 172.16.2.251/255.255.255.0 and the one I've defined into the Virtual sFlow Interface Network Address, port is 6343, and debug has been set to On. A tailf on /var/log/message return the following (much more for sure): Mar 29 11:33:10 eyes ntop[8471]: sampleType COUNTERSSAMPLE Mar 29 11:33:10 eyes ntop[8471]: sampleSequenceNo 5651 Mar 29 11:33:10 eyes ntop[8471]: sourceId 0:19 Mar 29 11:33:10 eyes ntop[8471]: statsSamplingInterval 60 Mar 29 11:33:10 eyes ntop[8471]: counterBlockVersion 1 Mar 29 11:33:10 eyes ntop[8471]: ifIndex 19 Mar 29 11:33:10 eyes ntop[8471]: networkType 117 Mar 29 11:33:10 eyes ntop[8471]: ifSpeed 100000000 Mar 29 11:33:10 eyes ntop[8471]: ifDirection 1 Mar 29 11:33:10 eyes ntop[8471]: ifStatus 3 Mar 29 11:33:10 eyes ntop[8471]: ifInOctets 1151905399127 Mar 29 11:33:10 eyes ntop[8471]: ifInUcastPkts 1145225876 Mar 29 11:33:10 eyes ntop[8471]: ifInMulticastPkts 5444 Mar 29 11:33:10 eyes ntop[8471]: ifInBroadcastPkts 2562311 Mar 29 11:33:10 eyes ntop[8471]: ifInDiscards 0 Mar 29 11:33:10 eyes ntop[8471]: ifInErrors 1 Mar 29 11:33:10 eyes ntop[8471]: ifInUnknownProtos 0 Mar 29 11:33:10 eyes ntop[8471]: ifOutOctets 172371426642 Mar 29 11:33:10 eyes ntop[8471]: ifOutUcastPkts 704058492 Mar 29 11:33:10 eyes ntop[8471]: ifOutMulticastPkts 12849313 Mar 29 11:33:10 eyes ntop[8471]: ifOutBroadcastPkts 12397002 Mar 29 11:33:10 eyes ntop[8471]: ifOutDiscards 0 Mar 29 11:33:10 eyes ntop[8471]: ifOutErrors 0 Mar 29 11:33:10 eyes ntop[8471]: ifPromiscuousMode 1 Mar 29 11:33:10 eyes ntop[8471]: endSample ---------------------- Mar 29 11:33:11 eyes ntop[8471]: datagramSourceIP 251.2.16.172 Mar 29 11:33:11 eyes ntop[8471]: datagramSize 132 Mar 29 11:33:11 eyes ntop[8471]: unixSecondsUTC 1112113991 Mar 29 11:33:11 eyes ntop[8471]: datagramVersion 2 Mar 29 11:33:11 eyes ntop[8471]: agent 172.16.2.251 Mar 29 11:33:11 eyes ntop[8471]: packetSequenceNo 176510 Mar 29 11:33:11 eyes ntop[8471]: sysUpTime 4166505708 Mar 29 11:33:11 eyes ntop[8471]: samplesInPacket 1 Mar 29 11:33:11 eyes ntop[8471]: startSample ---------------------- Mar 29 11:33:11 eyes ntop[8471]: sampleType_tag 0:2 Mar 29 11:33:11 eyes ntop[8471]: sampleType COUNTERSSAMPLE Mar 29 11:33:11 eyes ntop[8471]: sampleSequenceNo 5652 Mar 29 11:33:11 eyes ntop[8471]: sourceId 0:21 Mar 29 11:33:11 eyes ntop[8471]: statsSamplingInterval 60 Mar 29 11:33:11 eyes ntop[8471]: counterBlockVersion 1 Mar 29 11:33:11 eyes ntop[8471]: ifIndex 21 Mar 29 11:33:11 eyes ntop[8471]: networkType 117 Mar 29 11:33:11 eyes ntop[8471]: ifSpeed 100000000 Mar 29 11:33:11 eyes ntop[8471]: ifDirection 1 Mar 29 11:33:11 eyes ntop[8471]: ifStatus 3 Mar 29 11:33:11 eyes ntop[8471]: ifInOctets 696722336339 Mar 29 11:33:11 eyes ntop[8471]: ifInUcastPkts 565653474 Mar 29 11:33:11 eyes ntop[8471]: ifInMulticastPkts 41 Mar 29 11:33:11 eyes ntop[8471]: ifInBroadcastPkts 92786 Mar 29 11:33:11 eyes ntop[8471]: ifInDiscards 0 Mar 29 11:33:11 eyes ntop[8471]: ifInErrors 2035717 Mar 29 11:33:11 eyes ntop[8471]: ifInUnknownProtos 0 Mar 29 11:33:11 eyes ntop[8471]: ifOutOctets 56464209045 Mar 29 11:33:11 eyes ntop[8471]: ifOutUcastPkts 342790372 Mar 29 11:33:11 eyes ntop[8471]: ifOutMulticastPkts 12852389 Mar 29 11:33:11 eyes ntop[8471]: ifOutBroadcastPkts 14864175 Mar 29 11:33:11 eyes ntop[8471]: ifOutDiscards 0 Mar 29 11:33:11 eyes ntop[8471]: ifOutErrors 0 Mar 29 11:33:11 eyes ntop[8471]: ifPromiscuousMode 1 Mar 29 11:33:11 eyes ntop[8471]: endSample ---------------------- > Sounds like it's not receiving data - are you sure you've configured > it and activated it? > > If so, then you'll have to rebuild with the debug switch for sflow and > see what's going on internally, but be prepared for a lot of output. > > -----Burton > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf > Of [EMAIL PROTECTED] > Sent: Tuesday, March 29, 2005 9:57 AM > To: [email protected] > Cc: [email protected] > Subject: RE: [Ntop] sFlow not working! > > This doens't help, no trafic at all are seem. If I look inside the > sFlow plugin page, I can see this at the end of the page: > > Number of Flows with Bad Data 0 > Total Number of Flows Processed 0 > > The sFlow Interface Statistics appears correctly. > It's look like the plugins work and receive data from the switch but > Ntop doesn't procced them. > >> Check the back traffic - this has come up before - IIRC there are two >> kinds of sFlow packets, one is some sort of summary which ntop sees >> and ignores. >> So you may not really be getting data. But I'm fuzzy on the details >> - google for it. Or check the FAQ and see if this makes sense: >> >> Q. sFlow doesn't work. >> A. Check this out: >> >> This talks about a bad experience I had setting up sFlow reception. >> For >> the longest >> time, I could see that ntop was getting sflow packets, but no >> data would show up. >> It turns out the switch I was exporting from didn't see any real >> traffic, and it was >> just sending COUNTERSAMPLE packets..... >> >> - - - - - - - - I figured out that it was indeed "invalid" sflow >> packets. >> >> Apparently, sflow sends COUNTERSAMPLE and FLOWSAMPLE packets. >> COUNTERSAMPLE packets >> give a quick look at interface counters on the machine, whereas >> FLOWSAMPLE packets >> are actual packet fragments from IP connections. Ntop seems to >> simply parse, >> debug_print, and discard COUNTERSAMPLE packets...which made it >> confusing to look at >> the debug output and say "wow, lots of sflow coming in!" when in >> fact it was just for >> show, as Burton suggested. I added more switches (with active >> connections) to the >> switches sending sflow packets and I now have hosts with pretty >> graphs. >> >> >> >> -----Burton >> >> -----Original Message----- >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf >> Of [EMAIL PROTECTED] >> Sent: Tuesday, March 29, 2005 8:14 AM >> To: [email protected] >> Subject: [Ntop] sFlow not working! >> >> Hello, >> >> I'm trying to activate sFlow with Ntop 3.1 and it's not working, no >> trafic visible. Here my config: >> >> sFlow version: 2.99 >> Local Collector UDP Port: 6343 >> Virtual sFlow Interface network Address: 172.16.0.0/255.255.0.0 >> >> Flow Senders IP is: 172.16.2.251 >> Flow Collector (Ntop) IP is: 172.16.1.215 >> >> Thanks, >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
