Re: netflow is correct but interface counters lie?!

From: Dylan Hall (dylan.hall@tsnz.net)
Date: Wed Feb 28 2001 - 12:32:48 PST

  • Next message: Dave Plonka: "ANNOUNCE: FlowScan-1.006 released"

    Does the PPP session use Van Jacobson header compression? This would
    cause the header to vary in size.

    Lars Michael Jogback wrote:
    >
    > > This is 4 bytes to much. I encounter this +4 bytes with UDP packets, too.
    > > Does it measure HDLC, too? Can I get the raw IP Counter with snmp?
    >
    > According to this Cisco FAQ the answer to your first question is yes,
    > ifInOctets contains HDLC (or PPP) header.
    >
    > http://www.cisco.com/warp/public/477/SNMP/snmp_faq.html#11
    >
    > > Strangely this +4 rule cannot applied everytimes. Especially with TCP data
    > > I have varying values, even different delta values for input and output.
    >
    > This sounds really strange...
    >
    > /LM
    >
    > --
    > cflowd mailing list
    > cflowd@caida.org 

    -- 
Dylan Hall
IP Engineer
TelstraSaturn Ltd
Ph: +64 4 9228400 Fax: +64 4 9228401
--
cflowd mailing list
cflowd@caida.org

    This archive was generated by hypermail 2b29 : Wed Feb 28 2001 - 12:52:45 PST