Re: What Am I measuring

From: Pierre Vander Vorst (pvanderv@cisco.com)
Date: Mon Apr 09 2001 - 08:31:16 PDT

  • Next message: Hans Wouters: "Re: What Am I measuring"

    Hi Hans,

    > If I look to the data for a dedicated interface to one of my peers, I get
    > different AS's as source AS.
    > I tought that if you were running in the configuration described above,
    > that you only could get 1 AS as source since I'm only measuring incoming
    > traffic on the links where I have flow export configured.

    If peer-as is configured, the src AS will be the BGP neighbor. And indeed
    you'll only count the incoming traffic on the NetFlow-enabled interface.
    Unless you configured NetFlow egress, but this is another story.

    > Am I only receiving incoming traffic on, these links ?

    NetFlow cares only about incoming traffic.

    > Because, if I count the 5 minute data on a link I get almost 10 procent
    > less traffic , than when I watch my mrtg interface statistics.

    MRTG is SNMP based, and the SNMP counters are including the L2 headers.
    NetFlow is only counting L3 and above. That is probably the explanation.
    Check the SNMP FAQ's :

       http://www.cisco.com/warp/public/477/SNMP/snmp_faq.html

    Regards,

    Pierre

    > From cflowd-owner@ipn.caida.org Mon Apr 9 17:17:29 2001
    > Return-Path: <cflowd-owner@ipn.caida.org>
    > X-Authentication-Warning: ipn.caida.org: petidomo set sender to cflowd-owner@caida.org using -f
    > Date: Mon, 9 Apr 2001 17:09:08 +0200 (CEST)
    > From: Hans Wouters <hans.wouters@belbone.net>
    > To: cflowd@caida.org
    > Subject: What Am I measuring
    > Sender: cflowd-owner@ipn.caida.org
    > Precedence: list
    >
    > Hi,
    >
    > I have flow export version 5 , peer-as configured on my routers.
    > I'm running CFLOWD and I'm collecting AS-MATRIX data.
    >
    > If I look to the data for a dedicated interface to one of my peers, I get
    > different AS's as source AS.
    >
    > I tought that if you were running in the configuration described above,
    > that you only could get 1 AS as source since I'm only measuring incoming
    > traffic on the links where I have flow export configured.
    >
    > Am I only receiving incoming traffic on, these links ?
    > Because, if I count the 5 minute data on a link I get almost 10 procent
    > less traffic , than when I watch my mrtg interface statistics.
    >
    > Can anyone clarify, or point me in the direction of some reading on this
    > subject.
    >
    > Greetings,
    >
    > Hans
    >
    > --
    > Hans Wouters
    > IP operations engineer
    > BELGACOM INTERNET BACKBONE
    > HW3341-RIPE
    >
    > --
    > cflowd mailing list
    > cflowd@caida.org
    >

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Mon Apr 09 2001 - 08:35:39 PDT