[j-nsp] Netflow data exporting ability on M160
Richard A Steenbergen
ras at e-gerbil.net
Sun Nov 28 13:09:49 EST 2004
On Sun, Nov 28, 2004 at 03:53:43PM +0800, Joe Shen wrote:
> > IIRC the magic cutoff for classic netflow processing
> > without one of the
> > funky service cards for it is 7000pps of sampled
> > data. With a 500:1 sample
> > rate, that means you would top out at 3.5Mpps. If
> > you're going to do more
> > than that, sample less frequently.
>
> sorry, I still do not understand.
>
> I run "show interfaces" on the M160 with three POS
> sampled. The results:
>
> so-1/3/0:
>
> Input rate : 2057187176 bps (572668 pps)
> Output rate : 1898785304 bps (619012 pps)
>
> so-3/1/0:
> Input rate : 2047617800 bps (563212 pps)
> Output rate : 1925071056 bps (615424 pps)
>
> so-6/0/0:
>
> Input rate : 2148126912 bps (612172 pps)
> Output rate : 2061728912 bps (655415 pps)
>
> The total packet rate is : 3637903pps. It exceed the
> capacity just a little, so I think it's not the
> situation that it should have 2/3 traffic missed.
Are you sure you are sampling the correct packets/interfaces? How are you
doing your sampling now? Firewall rule with "then sample"? What are your
actual netflow sampling settings (rate/run-length)?
--
Richard A Steenbergen <ras at e-gerbil.net> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)
More information about the juniper-nsp
mailing list