Subject: NetraMet "inconsistency"

From: Hendrik Visage <[email-masked]>
Date: Thu, 26 Oct 2000 11:06:09 +0200

Hi there,

 I'm trying to look at precedence traffic through our routers. However,
I don't seem to be able to account for ALL the traffic.

Please advise on the following usage and why the other traffic,

Following .srl:

--srl--
#Making use of NetFlowMet
save MeterID; save DSCodePoint; save SourceInterface; save DestInterface;
   count;

SET  7;# NeMaC command
FORMAT
  FlowRuleSet MeterID FlowIndex FirstTime "  "
  ToPDUs ToOctets " <->  " FromPDUs FromOctets
" [ " DSCodePoint " ]"
  "{ " SourceInterface "->" DestInterface " }" ;

Statistics;
--srl--

nm_rc output:

#---  netracollector udp-8995, udp-8996, udp-8997  243 flows   11kpps   5MBps   11:02:30 Thu 26 Oct 2000  ---
10%  17 1 1342   3m   759 419kB <->    2k   2MB [ 0 ]2->1 }
 7%  17 3 1373   2m   785 426kB <->    2k   1MB [ 0 ]5->1 }
 5%  17 2 1423  10m   965   1MB <->     0    0B [ 16 ]1->19 }
 5%  17 1 1338   3m    1k 582kB <->    1k 704kB [ 0 ]8->1 }
 5%  17 3 1366   2m    2k 936kB <->    2k 338kB [ 0 ]11->1 }
 5%  17 1 1343   3m    1k   1MB <->     0    0B [ 0 ]1->1 }
 5%  17 3 1374   2m    1k 678kB <->    2k 494kB [ 0 ]7->1 }
 4%  17 3 1370   2m    1k   1MB <->     0    0B [ 0 ]1->1 }
 4%  17 3 1375   2m   759 437kB <->    2k 633kB [ 0 ]9->1 }
 4%  17 1 1336   3m    1k 753kB <->   980 300kB [ 0 ]44->1 }
47%  bytes in 233 other flows

GReetz
Hendrik

---

From: Nevil Brownlee <[email-masked]>
Date: Fri, 27 Oct 2000 12:04:55 +1300 (New Zealand Daylight Time)

>  7%  17 3 1373   2m   785 426kB <->    2k   1MB [ 0 ]5->1 }

nm_rc only displays the top n (default top 10) flows, which is why
you're only seeing 10.  To see all the flows, use NeMaC instead;
you'll get all the flow records written to a flow data file.

If you're writing rulesets to aggregate the flows (so as to reduce
the amount of data you collect), remember that because each packet has
only a single codepoint (rather than two, as for IP addresses), you
can't use the DSCodePoint attribute as a way of determining flow
direction.   (You probably don't want to do that anyway :-)

The way in which the DSCodePoint attribute should be implemented
is one of the topics to be discussed in an RTFM2 BOF at the San Diego 
IETF meeting this December; your input to that would be much 
appreciated.

Cheers, Nevil

PS: NeTraMet-specific topics (such as your question about nm_rc) 
    should really be sent to the NeTraMet mailing list.

+---------------------------------------------------------------------+
| Nevil Brownlee                     Director, Technology Development |
| Phone: +64 9 373 7599 x8941        ITSS, The University of Auckland |
|   FAX: +64 9 373 7021      Private Bag 92019, Auckland, New Zealand |
+---------------------------------------------------------------------P