[c-nsp] nfSen / nfDump

[Nick Cutting]

So as usual -  my netflow routers are coming up with the correct size data in nfsen, but sFlow is about 2.5 times as much traffic.

Does anyone have a cisco sflow config that works with nfsen - sampling rate etc?

sflow sampling-rate 4096 <-- this is 512?
sflow max-sampled-size 128
sflow counter-poll-interval 30
sflow  max-datagram-size 1400
sflow collector-ip xx.xx.xx.xx vrf default source xx.xx.xx.xx
sflow collector-port 6343
sflow agent-ip xx.xx.xx.xx
no sflow extended switch

Then in nfsen - here:

Doesn't look like sflow daemon supports the -s sampling tag.

%sources = (
    'myRouter'  => { 'port' => '9901', 'col' => '#00ff00', 'type' => 'netflow', 'optarg' => ' -s -1000 '},
);

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Aaron Gould
Sent: Sunday, August 6, 2017 1:46 AM
To: 'Phil Mayers' <p.mayers at imperial.ac.uk>; cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] nfSen / nfDump

netflow

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Phil Mayers
Sent: Friday, August 4, 2017 3:08 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] nfSen / nfDump

On 03/08/17 22:53, Aaron Gould wrote:
> I do 1/512 sample rate on my asr9k's and usually multiple numbers 
> gathered in nfsen by 512 to normalize

sflow? Or netflow?
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/