RE: What Am I measuring

From: Nunes, Steve (Steve.Nunes@CoreExpress.net)
Date: Mon Apr 09 2001 - 09:32:07 PDT

  • Next message: Pierre Vander Vorst: "Re: What Am I measuring"

    Hans,

    From what I've seen, the peer-as is not a reliable indicator of which
    interface
    the incoming traffic was actually received on. The interface number is the
    best
    thing to look at for that. Perhaps someone else out there knows for sure,
    but maybe
    the peer-as reports the BGP neighbor AS of the "best" route. The interface
    you have
    enabled may not always be the best route for the addresses you are receiving
    traffic from.

    Steve

    -----Original Message-----
    From: Hans Wouters [mailto:hans.wouters@belbone.net]
    Sent: Monday, April 09, 2001 10:36 AM
    To: Pierre Vander Vorst
    Cc: cflowd@caida.org; hans.wouters@belbone.net
    Subject: Re: What Am I measuring

    Hi,

    First off all tanx for the reply, but

    Since I'm not only getting the peer-as as the source as, and peer-as is
    definitely configured on my routers, what could be wrong ?

    Greetings,

            Hans

    On Mon, 9 Apr 2001, Pierre Vander Vorst wrote:

    >
    > Hi Hans,
    >
    > > If I look to the data for a dedicated interface to one of my peers, I
    get
    > > different AS's as source AS.
    > > I tought that if you were running in the configuration described above,
    > > that you only could get 1 AS as source since I'm only measuring incoming
    > > traffic on the links where I have flow export configured.
    >
    > If peer-as is configured, the src AS will be the BGP neighbor. And indeed
    > you'll only count the incoming traffic on the NetFlow-enabled interface.
    > Unless you configured NetFlow egress, but this is another story.
    >
    > > Am I only receiving incoming traffic on, these links ?
    >
    > NetFlow cares only about incoming traffic.
    >
    > > Because, if I count the 5 minute data on a link I get almost 10 procent
    > > less traffic , than when I watch my mrtg interface statistics.
    >
    > MRTG is SNMP based, and the SNMP counters are including the L2 headers.
    > NetFlow is only counting L3 and above. That is probably the explanation.
    > Check the SNMP FAQ's :
    >
    > http://www.cisco.com/warp/public/477/SNMP/snmp_faq.html
    >
    > Regards,
    >
    > Pierre
    >
    > > From cflowd-owner@ipn.caida.org Mon Apr 9 17:17:29 2001
    > > Return-Path: <cflowd-owner@ipn.caida.org>
    > > X-Authentication-Warning: ipn.caida.org: petidomo set sender to
    cflowd-owner@caida.org using -f
    > > Date: Mon, 9 Apr 2001 17:09:08 +0200 (CEST)
    > > From: Hans Wouters <hans.wouters@belbone.net>
    > > To: cflowd@caida.org
    > > Subject: What Am I measuring
    > > Sender: cflowd-owner@ipn.caida.org
    > > Precedence: list
    > >
    > > Hi,
    > >
    > > I have flow export version 5 , peer-as configured on my routers.
    > > I'm running CFLOWD and I'm collecting AS-MATRIX data.
    > >
    > > If I look to the data for a dedicated interface to one of my peers, I
    get
    > > different AS's as source AS.
    > >
    > > I tought that if you were running in the configuration described above,
    > > that you only could get 1 AS as source since I'm only measuring incoming
    > > traffic on the links where I have flow export configured.
    > >
    > > Am I only receiving incoming traffic on, these links ?
    > > Because, if I count the 5 minute data on a link I get almost 10 procent
    > > less traffic , than when I watch my mrtg interface statistics.
    > >
    > > Can anyone clarify, or point me in the direction of some reading on this
    > > subject.
    > >
    > > Greetings,
    > >
    > > Hans
    > >
    > > --
    > > Hans Wouters
    > > IP operations engineer
    > > BELGACOM INTERNET BACKBONE
    > > HW3341-RIPE
    > >
    > > --
    > > cflowd mailing list
    > > cflowd@caida.org
    > >
    >

    -- 
    Hans Wouters
    IP operations engineer
    BELGACOM INTERNET BACKBONE
    HW3341-RIPE
    

    -- cflowd mailing list cflowd@caida.org

    -- cflowd mailing list cflowd@caida.org



    This archive was generated by hypermail 2b29 : Mon Apr 09 2001 - 09:41:02 PDT