Do I correctly understand your response as a way to measure loss of the actual
netflow packets themselves?
I am interested in knowing if there is a way to determine network packet loss
using netflow packets. In other words, how does a router represent the loss
and possible subsequent retransmission of a packet. Does it expire the current
flow and start a new flow? Are the resent packets added to the total of the
affected flow or ignored? Are there any separate counters in netflow of lost
packets?
Steve
Christian Hammers <ch@westend.com> wrote:
> On Thu, Mar 22, 2001 at 12:13:39PM -0800, Steve Cerruti wrote:
> > I have been attempting to ascertain if there is a way to measure packet
loss
> > via Netflow data. Is there enough information available to determine
packet
> > loss?
> Each router maintains a flow sequence number that is written
> in the netflow packet header. If you make a list for each router and
> always add the number of flow records to the sequence number you should get
> the next sequence number and thus are able to find missing flow numbers.
> (anybody a handy SQL statement for this?)
>
> bye,
>
> -christian-
>
> --
> Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0
> ch@westend.com Internet & Security for Professionals Fax 0241/911879
> WESTEND ist CISCO Systems Partner - Premium Certified
____________________________________________________________________
Get free email and a permanent address at http://www.netaddress.com/?N=1
-- cflowd mailing list cflowd@caida.org
This archive was generated by hypermail 2b29 : Thu Mar 22 2001 - 14:02:21 PST