Here are the command I've used to configure the network foundry switch: sflow enable sflow agent-ip 172.16.2.251 sflow polling-interval 60 sflow destination 172.16.1.215 sflow forwarding # on each interface
> A good place to start is to just monitor the interface you should be > seeing the sFlow packets come in on and make sure you see the sFlow > packets themselves come in. If not, I can probably help with your > Foundry config. > > C > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > [EMAIL PROTECTED] > Sent: Tuesday, March 29, 2005 9:22 AM > To: [email protected] > Cc: [email protected] > Subject: RE: [Ntop] sFlow not working! > > This IP/MASK is the one of my Network Foundry switch -> > 172.16.2.251/255.255.255.0 and the one I've defined into the Virtual > sFlow Interface Network Address, port is 6343, and debug has been set to > On. A tailf on /var/log/message return the following (much more for > sure): > > Mar 29 11:33:10 eyes ntop[8471]: sampleType COUNTERSSAMPLE > Mar 29 11:33:10 eyes ntop[8471]: sampleSequenceNo 5651 > Mar 29 11:33:10 eyes ntop[8471]: sourceId 0:19 > Mar 29 11:33:10 eyes ntop[8471]: statsSamplingInterval 60 > Mar 29 11:33:10 eyes ntop[8471]: counterBlockVersion 1 > Mar 29 11:33:10 eyes ntop[8471]: ifIndex 19 > Mar 29 11:33:10 eyes ntop[8471]: networkType 117 > Mar 29 11:33:10 eyes ntop[8471]: ifSpeed 100000000 > Mar 29 11:33:10 eyes ntop[8471]: ifDirection 1 > Mar 29 11:33:10 eyes ntop[8471]: ifStatus 3 > Mar 29 11:33:10 eyes ntop[8471]: ifInOctets 1151905399127 > Mar 29 11:33:10 eyes ntop[8471]: ifInUcastPkts 1145225876 > Mar 29 11:33:10 eyes ntop[8471]: ifInMulticastPkts 5444 > Mar 29 11:33:10 eyes ntop[8471]: ifInBroadcastPkts 2562311 > Mar 29 11:33:10 eyes ntop[8471]: ifInDiscards 0 > Mar 29 11:33:10 eyes ntop[8471]: ifInErrors 1 > Mar 29 11:33:10 eyes ntop[8471]: ifInUnknownProtos 0 > Mar 29 11:33:10 eyes ntop[8471]: ifOutOctets 172371426642 > Mar 29 11:33:10 eyes ntop[8471]: ifOutUcastPkts 704058492 > Mar 29 11:33:10 eyes ntop[8471]: ifOutMulticastPkts 12849313 > Mar 29 11:33:10 eyes ntop[8471]: ifOutBroadcastPkts 12397002 > Mar 29 11:33:10 eyes ntop[8471]: ifOutDiscards 0 > Mar 29 11:33:10 eyes ntop[8471]: ifOutErrors 0 > Mar 29 11:33:10 eyes ntop[8471]: ifPromiscuousMode 1 > Mar 29 11:33:10 eyes ntop[8471]: endSample ---------------------- > Mar 29 11:33:11 eyes ntop[8471]: datagramSourceIP 251.2.16.172 > Mar 29 11:33:11 eyes ntop[8471]: datagramSize 132 > Mar 29 11:33:11 eyes ntop[8471]: unixSecondsUTC 1112113991 > Mar 29 11:33:11 eyes ntop[8471]: datagramVersion 2 > Mar 29 11:33:11 eyes ntop[8471]: agent 172.16.2.251 > Mar 29 11:33:11 eyes ntop[8471]: packetSequenceNo 176510 > Mar 29 11:33:11 eyes ntop[8471]: sysUpTime 4166505708 > Mar 29 11:33:11 eyes ntop[8471]: samplesInPacket 1 > Mar 29 11:33:11 eyes ntop[8471]: startSample ---------------------- > Mar 29 11:33:11 eyes ntop[8471]: sampleType_tag 0:2 > Mar 29 11:33:11 eyes ntop[8471]: sampleType COUNTERSSAMPLE > Mar 29 11:33:11 eyes ntop[8471]: sampleSequenceNo 5652 > Mar 29 11:33:11 eyes ntop[8471]: sourceId 0:21 > Mar 29 11:33:11 eyes ntop[8471]: statsSamplingInterval 60 > Mar 29 11:33:11 eyes ntop[8471]: counterBlockVersion 1 > Mar 29 11:33:11 eyes ntop[8471]: ifIndex 21 > Mar 29 11:33:11 eyes ntop[8471]: networkType 117 > Mar 29 11:33:11 eyes ntop[8471]: ifSpeed 100000000 > Mar 29 11:33:11 eyes ntop[8471]: ifDirection 1 > Mar 29 11:33:11 eyes ntop[8471]: ifStatus 3 > Mar 29 11:33:11 eyes ntop[8471]: ifInOctets 696722336339 > Mar 29 11:33:11 eyes ntop[8471]: ifInUcastPkts 565653474 > Mar 29 11:33:11 eyes ntop[8471]: ifInMulticastPkts 41 > Mar 29 11:33:11 eyes ntop[8471]: ifInBroadcastPkts 92786 > Mar 29 11:33:11 eyes ntop[8471]: ifInDiscards 0 > Mar 29 11:33:11 eyes ntop[8471]: ifInErrors 2035717 > Mar 29 11:33:11 eyes ntop[8471]: ifInUnknownProtos 0 > Mar 29 11:33:11 eyes ntop[8471]: ifOutOctets 56464209045 > Mar 29 11:33:11 eyes ntop[8471]: ifOutUcastPkts 342790372 > Mar 29 11:33:11 eyes ntop[8471]: ifOutMulticastPkts 12852389 > Mar 29 11:33:11 eyes ntop[8471]: ifOutBroadcastPkts 14864175 > Mar 29 11:33:11 eyes ntop[8471]: ifOutDiscards 0 > Mar 29 11:33:11 eyes ntop[8471]: ifOutErrors 0 > Mar 29 11:33:11 eyes ntop[8471]: ifPromiscuousMode 1 > Mar 29 11:33:11 eyes ntop[8471]: endSample ---------------------- > > > >> Sounds like it's not receiving data - are you sure you've configured >> it and activated it? >> >> If so, then you'll have to rebuild with the debug switch for sflow and > >> see what's going on internally, but be prepared for a lot of output. >> >> -----Burton >> >> -----Original Message----- >> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf >> Of [EMAIL PROTECTED] >> Sent: Tuesday, March 29, 2005 9:57 AM >> To: [email protected] >> Cc: [email protected] >> Subject: RE: [Ntop] sFlow not working! >> >> This doens't help, no trafic at all are seem. If I look inside the >> sFlow plugin page, I can see this at the end of the page: >> >> Number of Flows with Bad Data 0 >> Total Number of Flows Processed 0 >> >> The sFlow Interface Statistics appears correctly. >> It's look like the plugins work and receive data from the switch but >> Ntop doesn't procced them. >> >>> Check the back traffic - this has come up before - IIRC there are two > >>> kinds of sFlow packets, one is some sort of summary which ntop sees >>> and ignores. >>> So you may not really be getting data. But I'm fuzzy on the details >>> - google for it. Or check the FAQ and see if this makes sense: >>> >>> Q. sFlow doesn't work. >>> A. Check this out: >>> >>> This talks about a bad experience I had setting up sFlow > reception. >>> For >>> the longest >>> time, I could see that ntop was getting sflow packets, but no >>> data would show up. >>> It turns out the switch I was exporting from didn't see any real > >>> traffic, and it was >>> just sending COUNTERSAMPLE packets..... >>> >>> - - - - - - - - I figured out that it was indeed "invalid" sflow > >>> packets. >>> >>> Apparently, sflow sends COUNTERSAMPLE and FLOWSAMPLE packets. >>> COUNTERSAMPLE packets >>> give a quick look at interface counters on the machine, whereas >>> FLOWSAMPLE packets >>> are actual packet fragments from IP connections. Ntop seems to >>> simply parse, >>> debug_print, and discard COUNTERSAMPLE packets...which made it >>> confusing to look at >>> the debug output and say "wow, lots of sflow coming in!" when in > >>> fact it was just for >>> show, as Burton suggested. I added more switches (with active >>> connections) to the >>> switches sending sflow packets and I now have hosts with pretty >>> graphs. >>> >>> >>> >>> -----Burton >>> >>> -----Original Message----- >>> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf >>> Of [EMAIL PROTECTED] >>> Sent: Tuesday, March 29, 2005 8:14 AM >>> To: [email protected] >>> Subject: [Ntop] sFlow not working! >>> >>> Hello, >>> >>> I'm trying to activate sFlow with Ntop 3.1 and it's not working, no >>> trafic visible. Here my config: >>> >>> sFlow version: 2.99 >>> Local Collector UDP Port: 6343 >>> Virtual sFlow Interface network Address: 172.16.0.0/255.255.0.0 >>> >>> Flow Senders IP is: 172.16.2.251 >>> Flow Collector (Ntop) IP is: 172.16.1.215 >>> >>> Thanks, >>> >>> _______________________________________________ >>> Ntop mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop >>> >>> _______________________________________________ >>> Ntop mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop >>> >> >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > ********************************************************************** > Confidential/Proprietary Note > > The information in this email is confidential and may be legally > privileged. Access to this email by anyone other than the intended > addressee is unauthorized. If you are not the intended recipient of this > message, any review, disclosure, copying, distribution, retention, or any > action taken or omitted to be taken in reliance on it is prohibited and > may be unlawful. If you are not the intended recipient, please reply to > or forward a copy of this message to the sender and delete the message, > any attachments, and any copies thereof from your system. Thank you. > Guardian Mortgage Documents, Inc. > 225 Union Boulevard, Suite 200 > Lakewood, CO 80228. > ********************************************************************** > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
