They appear frequently. Every 10-15 secs. We have between 25-80Mbps running across the interfaces recording netflow data on the enterasys through out the day. Not all the traffic is getting recorded when compared to port statistics. No real pattern that we have found. We have 1Gbps connections from the enterasys to the collector and the collector is a HP 2 CPU opteron box with 8GB of memory. CPU is seeing very little use at all times.
----- Original Message ---- From: Paolo Lucente <pa...@pmacct.net> To: pmacct-discussion@pmacct.net Sent: Wed, January 13, 2010 3:33:36 PM Subject: Re: [pmacct-discussion] Enterasys nfacctd expecting flow error Hi Marc, Such messages tell it has been detected some issues with NetFlow datagram sequence numbers. This can be caused by packet loss between an agent and the collector, mistakes in the sequencing encoding among the others. Besides the warning messages, which can be turned off, NetFlow datagrams reaching pmacct are processed as usual. Do you see such messages appearing regularly or occasionally? Can you spot a pattern (ie. only a subset of the devices are affected, jumps repeat the same way, etc.)? Cheers, Paolo On Wed, Jan 13, 2010 at 11:52:07AM -0800, marc slice wrote: > I have setup netflow from an Enterasys N series switch and receive the > following when running nfacctd. > > WARN: expecting flow '2727940030' but received '2727940026' > collector=0.0.0.0:2055 agent=172.16.32.2:513 > WARN: expecting flow '11226450' but received '11226438' > collector=0.0.0.0:2055 agent=172.16.32.2:769 > WARN: expecting flow '2727940052' but received '2727940056' > collector=0.0.0.0:2055 agent=172.16.32.2:513 > WARN: expecting flow '11226456' but received '11226468' > collector=0.0.0.0:2055 agent=172.16.32.2:769 > WARN: expecting flow '2727952866' but received '2727952852' > collector=0.0.0.0:2055 agent=172.16.32.2:513 > WARN: expecting flow '11226618' but received '11226617' > collector=0.0.0.0:2055 agent=172.16.32.2:769 > WARN: expecting flow '2727952868' but received '2727952882' > collector=0.0.0.0:2055 agent=172.16.32.2:513 > > Couldn't find much info on this problem and was wondering if someone could > help? > > [ ... ] _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
