[c-nsp] nfSen / nfDump

[Nick Cutting]

Thank you for your reply.

Yes, I have a very similar config to yours below.

Looks like I'll need to tell the noc to halve their findings.
I didn’t seem to be able to use that command on a Nexus 9200 - the guide for the shell seems for the 9500 and the 3k?

Thank you

-----Original Message-----
From: Nick Hilliard [mailto:nick at foobar.org] 
Sent: Monday, August 28, 2017 5:13 PM
To: Nick Cutting <ncutting at edgetg.com>
Cc: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] nfSen / nfDump

This message originated from outside your organization

Nick Cutting wrote:
> Doesn't look like sflow daemon supports the -s sampling tag.
> 
> %sources = (
>     'myRouter'  => { 'port' => '9901', 'col' => '#00ff00', 'type' => 
> 'netflow', 'optarg' => ' -s -1000 '}, );

yes, that's correct.  The sflow sampling rate is specified in each sflow packet, so there is no need to specify it on the collector - it's automatically detected on a per-packet basis.

This is a working config on a small site (albeit a different sflow agent platform, but that won't make any difference):

> %sources = (
>         'rtr01' => { 'port' => '2055', 'col' => '#0000ff', 'type' => 'sflow' },
>         'rtr02' => { 'port' => '2056', 'col' => '#00ff00', 'type' => 
> 'sflow' }, );

nfsen will then start up sfcapd instead of nfcapd.

Nick