Thanks Paolo. Your analysis really helped me to solve the problem. Actually I needed to monitor traffic on one port particularly. I enabled sflow on that port only and I am getting accurate values of IN and OUT bytes.
Thanks again for your analysis. -----Original Message----- From: Paolo Lucente [mailto:[EMAIL PROTECTED] Sent: Friday, December 21, 2007 3:55 AM To: Atharkar, Amit Cc: [email protected] Subject: Re: [pmacct-discussion] Sfacctd showing weird byte count Hi Amit, having the same packet sampled multiple times is not ideal for having accurate data. Here are a few advices, depending on the scanario some may apply, some may not: * if the same packet could be sampled multiple times by the same switch but in different VLANs, you can introduce VLANs while aggregating data in sfacctd: aggregate: src_host,dst_host,vlan The result will be that if the packet is sampled multiple times while traversing in different VLANs, each of these samples will contribute to a distinct aggregate. * if the same packet could be sampled multiple times but by different switches, you can have a look to Pre-Tagging; basically samples received by different switches will receive a different tag so that you can now recognize which sample belongs to which switch: pre_tag_map: /path/to/pretag.map aggregate: src,host,dst_host,tag Then inside the pretag.map: id=1 ip=<IP address switch 1> id=2 ip=<IP address switch 2> ... * if, again, the same packet could be sampled multiple times by the same switch but in different VLANs you can choose a single VLAN and filter out all the remaining ones: plugins: memory[a] aggregate[a]: src_host,dst_host aggregate_filter[a]: vlan <VLAN ID> This method has limited applicability but has the pro of avoiding duplicate data to finish in the memory table. Hope this helps! Cheers, Paolo On Wed, Dec 19, 2007 at 10:47:56PM +0530, Atharkar, Amit wrote: > Hi Paolo, > > Thanks for replying. > > > 1) Sampling rate is 512. Polling interval is 60 sec. > 2) IF I make sfacctd_renormalize to false it gives the byte count in few > bytes only. > 3) The flow was initially traversed between two sflow enabled switches > which were sending samples to same receiver. Sflow was disabled on one > switch before taking the statistics. > 4) Again Sflow is traversed twice in the same switch in different vlans. > > > Network diagram is > > Sflow is enabled on this Switch. 6400cl is default router for ALL VLANS > ====================== > | HP 6400cl | > ====================== > # > # 10GB Trunk (Present in all vlans of both > switch) > # > ====================== > | | | | | | | HP 3400cl > ====================== > All respective vlans are Present on both the switches. > > Sflow collector is connected to 3400cl switch. 3400cl is again connected > to default gateway of company for internet connectivity. > > I am using sflowenable tool for setting up sflow mibs on 6400cl switch > > # setsflow 10.4.1.254 xxxxxxx 10.4.1.253 6343 512 60 604800 1 > > Will you please let me know to deal with this situation? "This email message and any attachments are confidential information of Starent Networks, Corp. The information transmitted may not be used to create or change any contractual obligations of Starent Networks, Corp. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this e-mail and its attachments by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify the sender immediately -- by replying to this message or by sending an email to [EMAIL PROTECTED] -- and destroy all copies of this message and any attachments without reading or disclosing their contents. Thank you." _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
