RE: Cflowd Message: failed to create flows

From: Hanumanth Jerbandi (SSD-BLRAKS-IC&NI) (Hanu@wipro.co.in)
Date: Mon Dec 10 2001 - 21:56:39 PST

  • Next message: Gunnar Ingvi: "Flows"

    hi ...

       Well i am using in an enterprise n/w to monitor interoffice links, i hv
    MRTG, but not happy with it. My management team is intersted in monitoring
    traffic based on services.

    I hv a central router which connects to other locations. I hv configured
    netflow on the
    central router(7200) and monitoring a single serial(locations). All leased
    lines are of
    2mbps(E1) connecting to central location. I hv seen the flows exported for a
    single serial
    is a max of 160kbps average(total flow file size is max 2mb for 5 min in
    peak hrs).

       I can enable all the interfaces for netflow, but all the flows will be in
    one rrd files.
    which i want to collect saperate flows for each configured serial
    interfaces. Similarly
    i want collect flows for 2 different routers.

      May be setting up clfowd for the above setup looks complicated, want to
    know if it
    can be done.

      My other question:

       I see the ioservice graph has in/out swaped, how to fix it???

       thanks
        hanu

    -----Original Message-----
    From: R. Drew Davis
    To: Hanumanth Jerbandi (SSD-BLRAKS-IC&NI)
    Cc: cflowd@caida.org
    Sent: 12/11/01 10:36 AM
    Subject: Re: Cflowd Message: failed to create flows

    > Date: Tue, 11 Dec 2001 08:59:30 +0530
    > From: "Hanumanth Jerbandi (SSD-BLRAKS-IC&NI)"
    <Hanu@wipro.co.in>
    > To: "'R. Drew Davis'" <drew@research.bell-labs.com>,
    alaerte@embrate
    l.com.br
    > Subject: RE: Cflowd Message: failed to create flows
    > Cc: cflowd@caida.org
    >
    >hi... Drew...
    >
    > I hv a query on cflowd, Hv u tried to run multiple instances of
    >cflowd/flowscan.
    > I want to collect flows saperately for 2/more different
    >routers/serials, or want to
    > collect saperate(stored in respective ip address dir) flows for
    2 or
    >more serials on the same router.
    >
    > In fact i had posted this to mailing list... but i didnt get any
    >reply...
    > hope if u can help me.
    >
    > I hv seen that graphs reported for i0services is reversed, i.e in/out
    are
    >swaped, how to fix it. Does the ifindex on the router changes!!!, i hv
    >noticed this
    >
    >
    > thanks,
    > hanu

    I think I remember seeing your e-mail to the list. My own cflowd
    setup
    is pretty simple. Had 2 routers feeding one data collector. At the
    moment, I'm not even collecting cflowd data.

    Not only that, but our routers were nearly all ethernet, except for one
    DS3
    to Holmdel, so I've very little experience with serial lines and
    netflow.

    Sometimes I'm able to help people on the list by making informed
    guesses,
    but I try to stop myself from making uninformed guesses to the list.
    (My Dad's advice was "Better to let people think you are dumb than to
    open your mouth and prove it to them").

    So, I hope someone else on the list has a bit more relevant experience
    and
    a smidge of free time to try to help you out with your question. Sorry
    I can't be of better service to you.

    You want to run 2 instances of cflowd on the same server? Going to
    need a ton of shared memory and disk space and bandwidth to make that
    work, assuming traffic is going to be heavy. As long as you make the
    config files such that the streams don't cross each other, seems like it
    should work. But remember Egon Spengler's advice: Crossing the
    streams would be bad.

    Editorializing a bit --- It isn't obvious to me: Why do you want
    separate collectors? You might get more attention from the list if
    you can convince people its an interesting problem that they might want
    to pursue for their own purposes.

    Drew

    R. Drew Davis, Room MH 2C-302A E-mail: drew@bell-labs.com
    Bell Laboratories Voice: 908-582-7280
    600 Mountain Ave. Fax: 908-582-3340
    Murray Hill, NJ 07974

    Bell Laboratories: The Research & Development Unit of Lucent
    Technologies.

            Disclaimer

                    Information contained and transmitted by this E-MAIL is
    proprietary to Wipro Limited and is intended for use only by the individual
    or entity to which it is addressed, and may contain information that is
    privileged, confidential or exempt from disclosure under applicable law. If
    this is a forwarded message, the content of this E-MAIL may not have been
    sent with the authority of the Company. If you are not the intended
    recipient, an agent of the intended recipient or a person responsible for
    delivering the information to the named recipient, you are notified that
    any use, distribution, transmission, printing, copying or dissemination of
    this information in any way or in any manner is strictly prohibited. If you
    have received this communication in error, please delete this mail & notify
    us immediately at mailadmin@wipro.co.in

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Mon Dec 10 2001 - 22:14:08 PST