Hi Ed,

Does your RSP720 support sampled netflow by chance?

-Brent

From: pmacct-discussion [mailto:[email protected]] On Behalf 
Of Edward Henigin
Sent: Friday, May 24, 2013 1:40 PM
To: [email protected]
Subject: [pmacct-discussion] Tips on dealing with overflowing 32-bit fields?

Hi y'all,

I'm hoping that someone has some experience that might help.

I'm using nfacctd to collect flows from a Cisco RSP720. After banging my head 
against the keyboard for a few days, I realized I should have configured pmacct 
with --enable-64bit. After re-building with that, accuracy is dramatically 
improved, but I'm still finding bytes being under-reported in numerous 
intervals.

I believe the problem I'm running into is that the RSP720 is collecting its 
data in a 32-bit field and that field is wrapping -- or, the netflow v5 packet 
uses 32 bits for bytes, and it's wrapping on export. In any case, I think the 
byte count is lost before it leaves the Cisco.

I'm using the "interface-destination" flow mask. I've tried using 
"interface-destination-source" but that causes some CPU load on the Cisco and 
flow creation failures.

To have the highest resolution and to minimize the risk of netflow creation 
failures, all the timers are set to the lowest:

             enable timeout  packet threshold
             ------ -------  ----------------
normal aging true       32         N/A
fast aging   true       32         7
long aging   true       64         N/A

2**32 bytes in 64 seconds is only 537 Mbps. Doesn't work very well for 
multi-gigabit traffic servers.

Does anyone have any ideas on how to reduce or eliminate counter wrap on the 
Cisco side for the bytes counter?

Many thanks,

Ed
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to