I would suggest checking the flow of Netflow Exports into the
collector. The problem may be upstream of the collector, and so it's
worth eliminating this possibility. If you run some utility like
tcpdump (also on the collector), you can get a rough idea of the
number of flows coming in. Something like "tcpdump 'udp port 2055'
>some_file" (untested) should pick up Netflow Exports on the default port. After collecting for some time you should have enough data to run through a simple Perl script that counts up and displays the number of bytes for each 5 minute period.
If your collector is too busy to handle the extra load the tcpdump
introduces, and you are forced to run it on a different machine on the
same LAN, remember that switches usually send traffic only to the one
port the traffic is destined for. :-)
Hope this helps,
"Olney, Matthew" wrote:
> I am collecting data from three Cisco 7206s. When I first kick off
> cflowdmux and cflowd, they gather files of about 27 Mb over 5 minutes. I'm
> using the flowscan patched version, so I'm dropping 5 minute datafiles.
> When it first begins, flowscan takes about 3 minutes to process the data.
> After about 30 minutes, there is an abrupt drop in data...there is still
> some data flowing, but very, very little. It then takes 20 seconds for the
> flowscan application to process the data. This drop is evident both in the
> graphs produced by flowscan, the time flowscan takes to process the 5 minute
> files, and the size of the 5 minute files. Because the 5 minute file size
> is small, I'm thinking there is a problem with the cflow set of programs.
> I am using cflowd-2-1-b1, on FreeBSD 4.3. This is the second box I've tried
> this on, both with the same sudden drop in traffic.
> Does anyone have any idea what is going on with this. Let me know if there
> is other information I can provide.
> cflowd mailing list
-- E-Mail: firstname.lastname@example.org Expert traffic analysis and visualisation xenaphobia: The fear of being beaten to a pulp by a leather-clad, New Zealand woman -- cflowd mailing list email@example.com
This archive was generated by hypermail 2b29 : Tue Jul 24 2001 - 13:27:54 PDT