How to calculate traffic using sFlowTrend?

[liu...@163.com]

Hello All,

I am a new bee to sFlowTrend. I would like to use sFlowTrend to calculate the traffic between two host, but unfortunately I do not know how to analyze the infomation.

For example, I use iperf to transmit traffic from src(10.10.8.2) to dst(10.10.10.2):

In the sFlowTrend UI, I can collect some infomation, but I don't know which one is useful for me. I focus on the Top N traffic charts, but I don't get any method to calculate the result, 112MBytes ,as the iperf shows.

In the switchs I set the polling interval as 30 second an the sampling-rate as 1:2000. 

How can I calculate the traffic between those two host using sFlowTrend? Can anyone help me?

Best Regards

[Sonia Panchen]

The Traffic >Top N chart shows the traffic rate (bits/s) trend over time. If you want to see the total volume of traffic transferred between two hosts in a given interval, then you can use Reports and create an query section using Advanced Settings (http://www.inmon.com/products/sFlowTrend/help/html/reports.edit.html#reports.edit.query.advanced) and select query fields sourceAddress, destinationAddress, bytesTotal and select output format “display results in Table”.

It looks as if you are running an iperf test for 10s. To get more accurate results, I suggest that you run the test for several minutes.

--
You received this message because you are subscribed to the Google Groups "sFlowTrend" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sflowtrend+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[liu...@163.com]

Hi Sonia,

Thanks for your help! I have tried to use the Reports and query section to calculate the total volume of traffic. This does work, but unfortunately it seems that the traffic data is very inaccurate.

For example, I used iperf to transmit about 30 second, 672 MBytes. I selected query fields sourceAddress, destinationAddress, bytesIn, bytesOut and bytesTotal. I tried five times, and the result was really confusing:

As the picture shows, the total volume of traffic are 6788403904 Bytes, 141439296200 Bytes(82893065140+58546231082), 1013915289 Bytes(885417933+128497356), 1074393249 Bytes (185338666+889054583) and 1032844094 Bytes(173683457+859160637). None of them are approximately equal to 672 MBytes, which means 704643072 Bytes.

I also used iperf to test about 3 minutes, about 1.97 GBytes., and the result of Reports was about 2.9G Bytes(977421810+925184583+1002353211+231194662) :

I am really confused with these results. Is there anything wrong with my data? How can I convert these results to the real volume of traffic(672 MBytes or 1.97 GBytes)? Or should I use the polling interval or the sampling rate to process these data? 

Thanks for your help!

Best,

liuzf

  

[Sonia Panchen]

First of all, I suggest that you use "Display results in: Table” and not Table (trend) - this will give you the total for the whole interval and not a value for each minute. You can also use the scale function so that the values are expressed in MB (see http://www.inmon.com/products/sFlowTrend/help/html/reference.databaseFns.html#reference.databaseFns.valueFns.scale)

To get a better idea of what is happening, I suggest that you run the test for much more than 3 minutes and that set the sampling rate to be much more frequent, for example 1:200.

However, I think that it is possible that the sFlow data generated by your switch is not correct. Which switches are you using?

[liu...@163.com]

OK. I will try again tomorrow and affix the results here.

By the way, the switches that I'm using are Pica8 P3290 and H3C S5820.

Thanks!

Best,

liuzf

[liu...@163.com]

Hi Sonia,

I have tried to set the sampling rate as 1:200 and use "Display results in: Table” to show the total volume of traffic with the scale function. Now The polling interval is 30 seconds and the sampling rate is 1:200. The results are still inaccurate and the error is getting bigger and bigger with the increase of test time:

Maybe there is something wrong with my switches. I will update switches and test again recently and affix the results here.

Best,

liuzf

 

[liu...@163.com]

Hi Sonia,

I upgraded my switches this afternoon and tested again. The results are still very inaccurate. For example, I use iperf to transmit about 30 second, about 672MBytes. The Reports shows that the total volume of traffic can be almost 136000MBytes and the rate can be 19GBits/s, but the bandwidth is just 100MByte/s. And the error is getting bigger and bigger with the increase of test time. 

The manufacturer of Pica8 tells me that the sFlow function of Pica8 P3290(PicaOS 2.8.1)  is very accurate, but I still can not get the real volume of traffic. What should I do now?

Best,

liuzf

[Sonia Panchen]

I think that the next step is to capture a trace of the sFlow that the Pica8 switch is sending and look at this in detail. Please run the perf session for at least 5 minutes and capture a trace of at least 5 minutes, filtering on just the sFlow from the Pica8 switch.

If you are running sFlowTrend on Linux, then you can use tcpdump to capture the sFlow with something like:

tcpdump -s0 -w sflowPica8.pcap udp port 6343 and src <IP of Pica8> 

On Windows you can use Wireshark

I will contact you separately about how to transfer the trace file.

[liu...@163.com]

Hi Sonia,

I haven't tried to capture a trace of the sFlow packet yet, because it seems that I can use the "counter" chart to calculate the total traffic of a specific port. 

For example, in the following figure, the data above is the result of iperf, and the data below is my calculation based on the chart. I know it is not very accurate because I use bandwidth to approximate the transmission speed, but the error seems to be acceptable. Although this method is a little bit complex, I can use those infomation to calculate the traffic between two host combining with the topology of network.

Is this method desirable?

I will try to use wireshark to capture a trace of the sFlow and transfer it to you later.

Best,

liuzf

[liu...@163.com]

Hi Sonia,

You told me that the next step was to capture a trace of the sFlow that the Pica8 switch is sending and look at this in detail on sflowTrend. I'm sorry that I can not login dropbox, so I have to send my trace of the sFlow to you by email. 

I used wireshark to get those infomation. I used iperf to conduct two 10-minute test and those two file are sflow packets from the eighth minute to the tenth minute. My email address is liu...@163.com, and I have sent those files to your email(span...@gmail.com).

I also attach one of those two files here.

Best,

liuzf

[Sonia Panchen]

Hello,

Thank you for sending the pcap traces of the sFlow from the Pica8 switches. I have looked at these and notice that there are a number of problems with the flow (packet) samples. For example, the sample pool is not being updated with every sample and the egress port information is given very erratically. Given this, it is hard to see how you can get any sensible data from the sFlow from these Pica8 switches. I suggest that you discuss this with Pica8 and ask them to fix the implementation to bring it into compliance with the sFlow specification.

I have not looked at the counter samples, but from your earlier message it sounds as if these are reasonably accurate (Traffic>Counters tab). As you have noted using counter data to measure traffic between two hosts can be complex and relies on knowledge of the topology, routing etc. Usually we would not suggest this method.

--
You received this message because you are subscribed to the Google Groups "sFlowTrend" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sflowtrend+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

<sflowResult2.pcapng>