RES: [Flow-tools] Flow in samples

[Caio Brentano]

Changing the question: Can I analyse sFlow and Netflow together? 

I mean flow-capture is set for Netflow V5. One process collect from a
Netflow from a Cisco router, other process collect from a Juniper. I have to
analyse theses flow files, but Juniper sends sampling flows! What I have to
do about Juniper flows?

-----Mensagem original-----
De: flow-tools-bounces at list.splintered.net
[mailto:flow-tools-bounces at list.splintered.net] Em nome de Caio Brentano
Enviada em: segunda-feira, 29 de outubro de 2007 10:25
Para: flow-tools at list.splintered.net
Assunto: RES: [Flow-tools] Flow in samples

Sorry, It's not clear for me! :-(
What snmp statistics you mean?

-----Mensagem original-----
De: bill fumerola [mailto:billf at mu.org] 
Enviada em: domingo, 28 de outubro de 2007 20:39
Para: Caio Brentano
Cc: flow-tools at list.splintered.net
Assunto: Re: [Flow-tools] Flow in samples

On Thu, Oct 25, 2007 at 12:31:12PM -0200, Caio Brentano wrote:
> What can I do about routers, like Juniper, that send flows in samples?

0) set a sample rate
1) make sure you're getting a consistant sample rate, not one that varies
   because too much is being sampled
2) configure flow-capture to write out files on a period that is (or is
   divisible by) your snmp collection period
3) collect snmp statistics on the same interfaces your flows are in/out
4) treat all flow data as percentages of the time period, use your snmp
   statistics to scale using those percentages

> Can flow-report treat cases like this?

not automatically.

-- 
- bill fumerola / billf at FreeBSD.org