Re: [Re: Packet Loss via Netflow]

From: Steve Cerruti (
Date: Thu Mar 22 2001 - 13:47:44 PST

  • Next message: R. Drew Davis: "Re: 'make' pukes on my machine"

    Do I correctly understand your response as a way to measure loss of the actual
    netflow packets themselves?

    I am interested in knowing if there is a way to determine network packet loss
    using netflow packets. In other words, how does a router represent the loss
    and possible subsequent retransmission of a packet. Does it expire the current
    flow and start a new flow? Are the resent packets added to the total of the
    affected flow or ignored? Are there any separate counters in netflow of lost


    Christian Hammers <> wrote:
    > On Thu, Mar 22, 2001 at 12:13:39PM -0800, Steve Cerruti wrote:
    > > I have been attempting to ascertain if there is a way to measure packet
    > > via Netflow data. Is there enough information available to determine
    > > loss?
    > Each router maintains a flow sequence number that is written
    > in the netflow packet header. If you make a list for each router and
    > always add the number of flow records to the sequence number you should get
    > the next sequence number and thus are able to find missing flow numbers.
    > (anybody a handy SQL statement for this?)
    > bye,
    > -christian-
    > --
    > Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0
    > Internet & Security for Professionals Fax 0241/911879
    > WESTEND ist CISCO Systems Partner - Premium Certified

    Get free email and a permanent address at

    cflowd mailing list

    This archive was generated by hypermail 2b29 : Thu Mar 22 2001 - 14:02:21 PST