Re: [j-nsp] unexpected results of traffic sampling

From: Przemyslaw Karwasiecki (karwas@ifxcorp.com)
Date: Fri Feb 01 2002 - 17:05:38 EST


My understanding was that rate 100 is actually 1%, not 100%.
It is consistent with a simple fact that total bandwith
of collected flows is equal to 1% of total bandwith on interface.

Przemek

On Fri, 2002-02-01 at 15:45, Anthony Pardini wrote:
>
> Rate 100 is 100%.
>
>
> try a: help reference forwrding-options rate
>
> [edit forwarding-options sampling input]
>
> Description
>
> Set the ratio of the number of packets to mark as candidates to be
> sampled. For example, if you specify a rate of 10, every tenth packet
> (1 packet out of 10) is marked as a candidate to be sampled.
>
>
> On 31 Jan 2002, Przemyslaw Karwasiecki wrote:
>
> > All,
> >
> > I am trying to setup cflowd collecting flows info from
> > sampled traffic on one of our M20.
> >
> > Everything is working fine, but I don't understand how it is
> > possible that despite of sampling only every 100th packets
> > I see a lot of records about complete flows with more then
> > a single packet.
> >
> > For me, it would imply that Juniper is actually sampling all
> > packets in selected flows, which seems to be in a contradiction to
> > "rate 100" parameter.
> >
> > Is there any mechanism implemented in Internet Processor II
> > which is identifying all packets in the flow and sending them
> > to Route Engine?
> >
> > How otherwise it is possible for /usr/sbin/sampled to see all
> > packets from a single flow?
> >
> > I would appreciate any explanation of this,
> >
> > Thank you
> >
> > Przemek
> >
> >
> > PS.
> > This is my configuration
> >
> > interfaces {
> > so-2/0/0 {
> > unit 500 {
> > description "OC3 PoS to UUNET";
> > family inet {
> > filter {
> > input sample;
> > }
> > address xxx.xxx.xxx.xxx/30;
> > }
> > }
> > }
> > }
> >
> > forwarding-options {
> > sampling {
> > input {
> > family inet {
> > rate 100;
> > run-length 0;
> > }
> > }
> > output {
> > cflowd xxx.xxx.xxx.xxx {
> > port 2055;
> > version 5;
> > }
> > }
> > }
> > }
> >
> > firewall {
> > filter sample {
> > term all {
> > then {
> > sample;
> > accept;
> > }
> > }
> > }
> > }
> >
> >
> >
>



This archive was generated by hypermail 2b29 : Mon Aug 05 2002 - 10:42:39 EDT