From: Christian Hammers (firstname.lastname@example.org)
Date: Mon Feb 03 2003 - 04:47:10 PST
On Mon, Feb 03, 2003 at 06:09:27PM +0530, Shabbir Husain wrote:
> However when i validate the results of my collector and a standard network
> management tool(using SNMP) , their is a difference of
> 3-300 % and more . I am clueless as to why there is so much difference .
With SNMP you most likely read interface statistics. Those statistics
include the Ethernet frame for each IP packet where netflow only counts
beginning with the IP header. Also the interface statistics count all
the various broadcasts (OSPF, Windows, spanning tree(?)) that gets not
forwarded and accounted on the router that does netflow.
Also keep in mind that you have to do netflow on all *incoming
interfaces*. If (answer) packets came from outside your net to the host
behind the router you have to enable it on the interface pointing to
your host and the interface pointing to your upstream provider(s).
-- Christian Hammers WESTEND GmbH | Internet-Business-Provider Technik CISCO Systems Partner - Authorized Reseller Lütticher Strasse 10 Tel 0241/701333-11 email@example.com D-52064 Aachen Fax 0241/911879
_______________________________________________ Cflowd mailing list Cflowd@caida.org http://login.caida.org/mailman/listinfo/cflowd
This archive was generated by hypermail 2.1.4 : Mon Feb 03 2003 - 04:55:30 PST