On Thu, Mar 22, 2001 at 01:47:44PM -0800, Steve Cerruti wrote:
> Do I correctly understand your response as a way to measure loss of the actual
> netflow packets themselves?
yes.
> I am interested in knowing if there is a way to determine network packet loss
> using netflow packets. In other words, how does a router represent the loss
> and possible subsequent retransmission of a packet. Does it expire the current
> flow and start a new flow? Are the resent packets added to the total of the
> affected flow or ignored? Are there any separate counters in netflow of lost
> packets?
The router itself does not care about any loss. Every router seems to have an
internal 32(?) bit counter that increments for each flow record. As there're
normally 1-30 records in a netflow packet the "sequence number" field in
the packet header will increase by 1-30 in every packet. So, if your netflow
server software stores this sequence number together with the routers IP
and the number transmitted records you should get a continuous list like this:
exporter sequence num. of records
212.117.12.34 1000000 30
212.117.12.34 1000030 30
212.117.99.44 1234900 15
212.117.12.34 1000060 30
212.117.99.44 1234915 30
...
Problem is that the records do not have to come in order. So you have to
sort them by exporter,sequence and then traverse through the list and check
if there're holes. loss=num_holes/num_packets.
> Steve
bye,
-christian-
-- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch@westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified -- cflowd mailing list cflowd@caida.org
This archive was generated by hypermail 2b29 : Fri Mar 23 2001 - 01:21:13 PST