RE: netflow is correct but interface counters lie?!

From: Lars Michael Jogback (lm@swip.net)
Date: Wed Feb 28 2001 - 09:54:15 PST

  • Next message: Scott V: "Re: new to this all (fwd)"

    > This is 4 bytes to much. I encounter this +4 bytes with UDP packets, too.
    > Does it measure HDLC, too? Can I get the raw IP Counter with snmp?

    According to this Cisco FAQ the answer to your first question is yes,
    ifInOctets contains HDLC (or PPP) header.

    http://www.cisco.com/warp/public/477/SNMP/snmp_faq.html#11

    > Strangely this +4 rule cannot applied everytimes. Especially with TCP data
    > I have varying values, even different delta values for input and output.

    This sounds really strange...

    /LM

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Wed Feb 28 2001 - 10:12:14 PST