Flowscan accuracy?

[Sean Watkins]

> 
> I doubt this is it, but could you be looking at a stacked 
> graph where the bandwidth utilization for each protocol is 
> stacked on the prior protocols which results in an incorrect 
> "total" bandwidth value, but correct per-protocol stats.
> 
> I'm attaching two graphs to illustrate:
> 20060621_ds3_daily_stacked.png - the view of my DS3 with 
> protcol "stacking" on. Notice that the scale is almost twice 
> that of a 45mbps DS3. 
> 20060621_ds3_daily_unstacked.png - the view of my DS3 without 
> protocol stacking. This is a true representation of the total 
> bandwidth used but the per protocol stats get a little obfuscated.
> 
> So you may be running into that issue. Of course the devil is 
> in the details with netflow - any number of other issues 
> could be causing errant data. Are you exporting the same data 
> from multiple routers and unknowningly adding it all together?
> 
> 

Thanks for the info.

The stacked graphs I understand, but I'm actually referring to the TopN
reports Flowscan can generate. Ie

CUFlow.cf:

# Keep top N lists 
# Show the top ten talkers, storing reports in /cflow/flows/reports
# and keeping the current report in /etc/httpd/data/reports/topten.html
Scoreboard 10 /var/netflow/scoreboard
/var/netflow/scoreboard/toptalkers.html

# Same, but build an over-time average top N list
AggregateScore 10 /var/netflow/rrds/agg.dat
/var/netflow/scoreboard/overall.html

ASScoreboard 10 /var/netflow/as /var/netflow/scoreboard/currentAS.html




I do have 2 routers exporting netflow data; flows should only be originating
from one router as the 2nd router is really only there for redunancy, and is
only in the loop if the 1st one is down?

Sean

--
Help        mailto:majordomo at net.doit.wisc.edu and say "help" in message body
Unsubscribe mailto:majordomo at net.doit.wisc.edu and say
"unsubscribe flowscan" in message body
Archive     http://net.doit.wisc.edu/~plonka/list/flowscan/archive/