[Cflowd] Re: Require NetFlow Assistance .

From: Christian Hammers (ch@westend.com)
Date: Mon Feb 03 2003 - 04:47:10 PST

  • Next message: Vinod Tete: "RE: [Cflowd] Require NetFlow Assistance ."

    On Mon, Feb 03, 2003 at 06:09:27PM +0530, Shabbir Husain wrote:
    > However when i validate the results of my collector and a standard network
    > management tool(using SNMP) , their is a difference of
    > 3-300 % and more . I am clueless as to why there is so much difference .
    With SNMP you most likely read interface statistics. Those statistics
    include the Ethernet frame for each IP packet where netflow only counts
    beginning with the IP header. Also the interface statistics count all
    the various broadcasts (OSPF, Windows, spanning tree(?)) that gets not
    forwarded and accounted on the router that does netflow.

    Also keep in mind that you have to do netflow on all *incoming
    interfaces*. If (answer) packets came from outside your net to the host
    behind the router you have to enable it on the interface pointing to
    your host and the interface pointing to your upstream provider(s).



    Christian Hammers             WESTEND GmbH  |  Internet-Business-Provider
    Technik                       CISCO Systems Partner - Authorized Reseller
                                  Lütticher Strasse 10     Tel 0241/701333-11
    ch@westend.com                D-52064 Aachen              Fax 0241/911879

    _______________________________________________ Cflowd mailing list Cflowd@caida.org http://login.caida.org/mailman/listinfo/cflowd

    This archive was generated by hypermail 2.1.4 : Mon Feb 03 2003 - 04:55:30 PST