Re: [Re: Packet Loss via Netflow]

From: Steve Cerruti (steve.cerruti@usa.net)
Date: Thu Mar 22 2001 - 13:47:44 PST

  • Next message: R. Drew Davis: "Re: 'make' pukes on my machine"

    Do I correctly understand your response as a way to measure loss of the actual
    netflow packets themselves?

    I am interested in knowing if there is a way to determine network packet loss
    using netflow packets. In other words, how does a router represent the loss
    and possible subsequent retransmission of a packet. Does it expire the current
    flow and start a new flow? Are the resent packets added to the total of the
    affected flow or ignored? Are there any separate counters in netflow of lost
    packets?

    Steve

    Christian Hammers <ch@westend.com> wrote:
    > On Thu, Mar 22, 2001 at 12:13:39PM -0800, Steve Cerruti wrote:
    > > I have been attempting to ascertain if there is a way to measure packet
    loss
    > > via Netflow data. Is there enough information available to determine
    packet
    > > loss?
    > Each router maintains a flow sequence number that is written
    > in the netflow packet header. If you make a list for each router and
    > always add the number of flow records to the sequence number you should get
    > the next sequence number and thus are able to find missing flow numbers.
    > (anybody a handy SQL statement for this?)
    >
    > bye,
    >
    > -christian-
    >
    > --
    > Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0
    > ch@westend.com Internet & Security for Professionals Fax 0241/911879
    > WESTEND ist CISCO Systems Partner - Premium Certified

    ____________________________________________________________________
    Get free email and a permanent address at http://www.netaddress.com/?N=1

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Thu Mar 22 2001 - 14:02:21 PST