Hi Paolo,
Thanks for replying.
1) Sampling rate is 512. Polling interval is 60 sec.
2) IF I make sfacctd_renormalize to false it gives the byte count in few
bytes only.
3) The flow was initially traversed between two sflow enabled switches
which were sending samples to same receiver. Sflow was disabled on one
switch before taking the statistics.
4) Again Sflow is traversed twice in the same switch in different vlans.
Network diagram is
Sflow is enabled on this Switch. 6400cl is default router for ALL VLANS
======================
| HP 6400cl |
======================
#
# 10GB Trunk (Present in all vlans of both
switch)
#
======================
| | | | | | | HP 3400cl
======================
All respective vlans are Present on both the switches.
Sflow collector is connected to 3400cl switch. 3400cl is again connected
to default gateway of company for internet connectivity.
I am using sflowenable tool for setting up sflow mibs on 6400cl switch
# setsflow 10.4.1.254 xxxxxxx 10.4.1.253 6343 512 60 604800 1
Will you please let me know to deal with this situation?
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
et] On Behalf Of Paolo Lucente
Sent: Tuesday, December 18, 2007 11:49 PM
To: [email protected]
Subject: Re: [pmacct-discussion] Sfacctd showing weird byte count
Hi Amit,
the strange thing is that 65MB is exactly five times 13MB. Which
sampling rate are you using? How things change by playing around
the sfacctd_renormalize option? Is it possible the data flow is
being over-estimated because, say, it's traversing multiple sFlow-
enabled switches or because it's routed and passes through the
same switch multiple times, maybe in different VLANs? Lastly,
can you also say which direction is the sFlow agent sampling
traffic (incoming or outgoing)?
Cheers,
Paolo
On Mon, Dec 17, 2007 at 06:31:03PM +0530, Atharkar, Amit wrote:
> Hi all,
>
>
>
> I am using pmacctd 0.11.4 to collect sflow data from HP 3400cl. I am
> able to receive the traffic but the byte count is weired. Reports
shows
> around 65 MB for 13 MB file download.
>
>
>
> As suggested by Paolo sfacctd_renormalize is also enabled.
>
>
>
> Can someone help me to make accounting more accurate?
>
>
>
> Sfacctd.conf
>
> =====================
>
> daemonize: false
>
> debug: true
>
> plugins: pgsql
>
> print_refresh_time: 20
>
> aggregate:src_host,dst_host
>
> interface: eth0
>
> promisc: false
>
> sfacctd_renormalize: true
>
> sql_db: pmacct
>
> sql_data: typed
>
> sql_passwd: pmacct12
>
> sql_table_version: 4
>
> sql_table: acct_v4
>
> sql_refresh_time: 30
>
> sql_history: 5m
>
> sql_history_roundoff: m
>
> snaplen: 750
>
> ====================
>
>
>
> Amit
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
"This email message and any attachments are confidential information of Starent
Networks, Corp. The information transmitted may not be used to create or change
any contractual obligations of Starent Networks, Corp. Any review,
retransmission, dissemination or other use of, or taking of any action in
reliance upon this e-mail and its attachments by persons or entities other than
the intended recipient is prohibited. If you are not the intended recipient,
please notify the sender immediately -- by replying to this message or by
sending an email to [EMAIL PROTECTED] -- and destroy all copies of this message
and any attachments without reading or disclosing their contents. Thank you."
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
