Re: [Re: Packet Loss via Netflow]

From: Christian Hammers (
Date: Fri Mar 23 2001 - 01:13:29 PST

  • Next message: Christian Hammers: "Re: Packet Loss via Netflow"

    On Thu, Mar 22, 2001 at 01:47:44PM -0800, Steve Cerruti wrote:
    > Do I correctly understand your response as a way to measure loss of the actual
    > netflow packets themselves?

    > I am interested in knowing if there is a way to determine network packet loss
    > using netflow packets. In other words, how does a router represent the loss
    > and possible subsequent retransmission of a packet. Does it expire the current
    > flow and start a new flow? Are the resent packets added to the total of the
    > affected flow or ignored? Are there any separate counters in netflow of lost
    > packets?
    The router itself does not care about any loss. Every router seems to have an
    internal 32(?) bit counter that increments for each flow record. As there're
    normally 1-30 records in a netflow packet the "sequence number" field in
    the packet header will increase by 1-30 in every packet. So, if your netflow
    server software stores this sequence number together with the routers IP
    and the number transmitted records you should get a continuous list like this:
     exporter sequence num. of records 1000000 30 1000030 30 1234900 15 1000060 30 1234915 30

    Problem is that the records do not have to come in order. So you have to
    sort them by exporter,sequence and then traverse through the list and check
    if there're holes. loss=num_holes/num_packets.

    > Steve


    Christian Hammers    WESTEND GmbH - Aachen und Dueren     Tel 0241/701333-0     Internet & Security for Professionals    Fax 0241/911879
               WESTEND ist CISCO Systems Partner - Premium Certified
    cflowd mailing list

    This archive was generated by hypermail 2b29 : Fri Mar 23 2001 - 01:21:13 PST