Traffic accounting for every flow

[Vasiliy Perelygin]

Hi!

Still cannot understand how to get a detailed information about each flow - is it possible to esimate the real quantity of frames per flow? I've read "Packet Sampling Basics"  and this message but still don't understand how to calculate data in the real world. 

I receive sFlow datagrams from ALU switch and see the following data:

The formula is:  

effective_sampling_ratio = delta(sample_pool) / samples_received

   frames(X) = samples_received(X) * effective_sampling_ratio

Stuck here... So my questions are:

1. How can I get "delta"? 

2.  What is "samples received" in my case? The sum of identical flows? 

3. What is the real meaning of "Sequence number"? Is it an Id of each unique flow?

I'll be happy to get answers on any of my questions ))

[Peter Phaal]

Each data source (in your table, Source Id) generated an independent sequence of measurements. The sequence number is incremented with each packet sample exported by the data source. In your example, four samples were received from data source 2038. The sample pool delta across all four samples from the data source is 11197440 - 11185152 = 12288. The sequence number delta for the data source is 3091 - 3088 = 3. This gives an effective sampling rate of 12288 / 3 = 4096 (which is the same as the reported sampling rate since no samples were lost).

With sFlow, it is up to you to define what constitutes a unique flow and to accumulate counts for the flow. For example, you might want to accumulate packet samples by ingress port. In this example, we received 3 samples with ingress port 2048 and 1 sample with ingress port 2038 from data source 2038. Multiply by the samples received counts by the sampling rate of 4096 to get an estimate of 12,288 packets with ingress port 2048 and 4096 packets with ingress port 2038.

[Vasiliy Perelygin]

Thank you very much, Peter!

вторник, 13 февраля 2024 г. в 03:01:59 UTC+3, Peter Phaal: