RE: netflow is correct but interface counters lie?!

From: Lars Michael Jogback (lm@swip.net)
Date: Wed Feb 28 2001 - 09:54:15 PST

Next message: Scott V: "Re: new to this all (fwd)"

Previous message: Saulius Riauba: "Re: cflowd-2-1-b1.tar.gz - tar: directory checksum error?"
In reply to: Christian Hammers: "netflow is correct but interface counters lie?!"
Next in thread: Dylan Hall: "Re: netflow is correct but interface counters lie?!"
Reply: Dylan Hall: "Re: netflow is correct but interface counters lie?!"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> This is 4 bytes to much. I encounter this +4 bytes with UDP packets, too.
> Does it measure HDLC, too? Can I get the raw IP Counter with snmp?

According to this Cisco FAQ the answer to your first question is yes,
ifInOctets contains HDLC (or PPP) header.

http://www.cisco.com/warp/public/477/SNMP/snmp_faq.html#11

> Strangely this +4 rule cannot applied everytimes. Especially with TCP data
> I have varying values, even different delta values for input and output.

This sounds really strange...

/LM

--
cflowd mailing list
cflowd@caida.org

Next message: Scott V: "Re: new to this all (fwd)"
Previous message: Saulius Riauba: "Re: cflowd-2-1-b1.tar.gz - tar: directory checksum error?"
In reply to: Christian Hammers: "netflow is correct but interface counters lie?!"
Next in thread: Dylan Hall: "Re: netflow is correct but interface counters lie?!"
Reply: Dylan Hall: "Re: netflow is correct but interface counters lie?!"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b29 : Wed Feb 28 2001 - 10:12:14 PST