[c-nsp] nfSen / nfDump

Nick Cutting ncutting at edgetg.com
Mon Aug 28 15:37:22 EDT 2017


This was an example I took from the nfsen forums - it is a negative value.

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Justin M. Streiner
Sent: Monday, August 28, 2017 3:32 PM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] nfSen / nfDump

Wouldn't the syntax be "-s 1000", rather than "-s -1000"?

jms

On Mon, 28 Aug 2017, Nick Cutting wrote:

> So as usual -  my netflow routers are coming up with the correct size data in nfsen, but sFlow is about 2.5 times as much traffic.
>
> Does anyone have a cisco sflow config that works with nfsen - sampling rate etc?
>
> sflow sampling-rate 4096 <-- this is 512?
> sflow max-sampled-size 128
> sflow counter-poll-interval 30
> sflow  max-datagram-size 1400
> sflow collector-ip xx.xx.xx.xx vrf default source xx.xx.xx.xx sflow 
> collector-port 6343 sflow agent-ip xx.xx.xx.xx no sflow extended 
> switch
>
> Then in nfsen - here:
>
> Doesn't look like sflow daemon supports the -s sampling tag.
>
> %sources = (
>    'myRouter'  => { 'port' => '9901', 'col' => '#00ff00', 'type' => 
> 'netflow', 'optarg' => ' -s -1000 '}, );
>
> -----Original Message-----
> From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf 
> Of Aaron Gould
> Sent: Sunday, August 6, 2017 1:46 AM
> To: 'Phil Mayers' <p.mayers at imperial.ac.uk>; cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] nfSen / nfDump
>
> netflow
>
> -----Original Message-----
> From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf 
> Of Phil Mayers
> Sent: Friday, August 4, 2017 3:08 AM
> To: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] nfSen / nfDump
>
> On 03/08/17 22:53, Aaron Gould wrote:
>> I do 1/512 sample rate on my asr9k's and usually multiple numbers 
>> gathered in nfsen by 512 to normalize
>
> sflow? Or netflow?
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/



More information about the cisco-nsp mailing list