RE: Netflow output question. Please help

From: Aleks Sheynkman (aleks@narus.com)
Date: Sat Aug 11 2001 - 15:45:04 PDT

  • Next message: Solomon Sokolovsky: "cflowd exporting to MySQL"

    Ok 256 is including UDP, CRC. I think I know what's going on
    I sending 256 bytes UDP packet ,
    -4 bytes CRC
    -14 bytes Ethernet header

    give us 238 which is correct.

    Does it make sense ??

    Thanks a lot for you help !

    -Aleks.
    -----Original Message-----
    From: Martin van den Nieuwelaar [mailto:martin@gadgets.co.nz]
    Sent: Saturday, August 11, 2001 3:37 PM
    To: Aleks Sheynkman
    Cc: cflowd@caida.org
    Subject: Re: Netflow output question. Please help

    Aleks Sheynkman wrote:
    >
    > Hello !
    >
    > I have small problem with the Netflow, I'm trying to send 100 UDP
    packets
    > through the routers and see what will come out of
    > Netflow, each packet is 256 bytes, so in the Netflow, I suppose to
    expect
    > to see 25,600 bytes sent trough the interface ,
    > but in some reason I always getting 23,800 bytes but number of packets
    > Netflow reports as a 100 .
    >
    > Any idea?

    The byte count reported by Netflow exports is supposed to be the
    number of layer 3 (IP) payload bytes. Above, and in your other post
    it isn't clear to me whether your IP data size is 256 bytes, or
    whether your UDP data size is 256 bytes (indicating an IP data size of
    256+8 for the UDP header = 264 bytes of IP data). Still, in any case
    these should result in more than 23800 bytes being measured.

    How about trying just one packet, and see if you get 238 bytes
    measured? This might enlighten us as to whether an incorrect number
    of bytes for each packet is being recorded, or maybe an incorrect
    number of packets. (Still, the latter seems unlikely as 23800 doesn't
    divide nicely by either 256 or 264...)

    Lastly, are you _sure_ you're not sending 238 bytes of layer 3 data?
    :-)

    >
    > Here is my configuration :
    >
    > Gig in |=============| POS OC3 out
    POS
    > OC3 in |=============| Gig OUT
    > ========= | Router A |
    > =============================== | Router B | =====================
    > |=============|
    > |=============|
    >
    >
    > Thanks a lot in advance !
    >
    > -Aleks.
    > --
    > cflowd mailing list
    > cflowd@caida.org

    -- 
    Expert carrier network traffic analysis and visualisation
    http://www.gadgets.co.nz/products.shtml
    xenaphobia: The fear of being beaten to a
    pulp by a leather-clad, New Zealand woman
    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Sat Aug 11 2001 - 15:54:27 PDT