[Ntop] sFlow not working!

gmourani at privalodc.com gmourani at privalodc.com
Tue Mar 29 21:08:41 CEST 2005 

> wich model of Foundry Switch are you configuring
It's a FastIron X424

> you can specify a sample rate N
I've already do it.


> Hello,
>
> please can you specify wich model of Foundry Switch are you configuring
> (and
> software running)?
> try to set sflow-polling interval to "0"
>
>
> then you can specify a sample rate N,
> rating is 1/N: you want to process 1 packets every N
> try to use lower value of N to increase the number of packets processed
>
> please note: increasing rating (with lower value of N) can be "expensive"
>
> regards
>
> Gio
>
>
> gmourani at privalodc.com wrote:
>> Here are the command I've used to configure the network foundry
>> switch: sflow enable
>> sflow agent-ip 172.16.2.251
>> sflow polling-interval 60
>> sflow destination 172.16.1.215
>> sflow forwarding # on each interface
>>
>>> A good place to start is to just monitor the interface you should be
>>> seeing the sFlow packets come in on and make sure you see the sFlow
>>> packets themselves come in. If not, I can probably help with your
>>> Foundry config.
>>>
>>> C
>>>
>>> -----Original Message-----
>>> From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On Behalf
>>> Of gmourani at privalodc.com
>>> Sent: Tuesday, March 29, 2005 9:22 AM
>>> To: ntop at Unipi.IT
>>> Cc: ntop at Unipi.IT
>>> Subject: RE: [Ntop] sFlow not working!
>>>
>>> This IP/MASK is the one of my Network Foundry switch ->
>>> 172.16.2.251/255.255.255.0 and the one I've defined into the Virtual
>>> sFlow Interface Network Address, port is 6343, and debug has been
>>> set to On. A tailf on /var/log/message return the following (much
>>> more for sure):
>>>
>>> Mar 29 11:33:10 eyes ntop[8471]:   sampleType COUNTERSSAMPLE
>>> Mar 29 11:33:10 eyes ntop[8471]:   sampleSequenceNo 5651
>>> Mar 29 11:33:10 eyes ntop[8471]:   sourceId 0:19
>>> Mar 29 11:33:10 eyes ntop[8471]:   statsSamplingInterval 60
>>> Mar 29 11:33:10 eyes ntop[8471]:   counterBlockVersion 1
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifIndex 19
>>> Mar 29 11:33:10 eyes ntop[8471]:   networkType 117
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifSpeed 100000000
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifDirection 1
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifStatus 3
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifInOctets 1151905399127
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifInUcastPkts 1145225876
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifInMulticastPkts 5444
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifInBroadcastPkts 2562311
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifInDiscards 0
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifInErrors 1
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifInUnknownProtos 0
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifOutOctets 172371426642
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifOutUcastPkts 704058492
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifOutMulticastPkts 12849313
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifOutBroadcastPkts 12397002
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifOutDiscards 0
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifOutErrors 0
>>> Mar 29 11:33:10 eyes ntop[8471]:   ifPromiscuousMode 1
>>> Mar 29 11:33:10 eyes ntop[8471]:   endSample   ----------------------
>>> Mar 29 11:33:11 eyes ntop[8471]:   datagramSourceIP 251.2.16.172
>>> Mar 29 11:33:11 eyes ntop[8471]:   datagramSize 132
>>> Mar 29 11:33:11 eyes ntop[8471]:   unixSecondsUTC 1112113991
>>> Mar 29 11:33:11 eyes ntop[8471]:   datagramVersion 2
>>> Mar 29 11:33:11 eyes ntop[8471]:   agent 172.16.2.251
>>> Mar 29 11:33:11 eyes ntop[8471]:   packetSequenceNo 176510
>>> Mar 29 11:33:11 eyes ntop[8471]:   sysUpTime 4166505708
>>> Mar 29 11:33:11 eyes ntop[8471]:   samplesInPacket 1
>>> Mar 29 11:33:11 eyes ntop[8471]:   startSample ----------------------
>>> Mar 29 11:33:11 eyes ntop[8471]:   sampleType_tag 0:2
>>> Mar 29 11:33:11 eyes ntop[8471]:   sampleType COUNTERSSAMPLE
>>> Mar 29 11:33:11 eyes ntop[8471]:   sampleSequenceNo 5652
>>> Mar 29 11:33:11 eyes ntop[8471]:   sourceId 0:21
>>> Mar 29 11:33:11 eyes ntop[8471]:   statsSamplingInterval 60
>>> Mar 29 11:33:11 eyes ntop[8471]:   counterBlockVersion 1
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifIndex 21
>>> Mar 29 11:33:11 eyes ntop[8471]:   networkType 117
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifSpeed 100000000
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifDirection 1
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifStatus 3
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifInOctets 696722336339
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifInUcastPkts 565653474
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifInMulticastPkts 41
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifInBroadcastPkts 92786
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifInDiscards 0
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifInErrors 2035717
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifInUnknownProtos 0
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifOutOctets 56464209045
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifOutUcastPkts 342790372
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifOutMulticastPkts 12852389
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifOutBroadcastPkts 14864175
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifOutDiscards 0
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifOutErrors 0
>>> Mar 29 11:33:11 eyes ntop[8471]:   ifPromiscuousMode 1
>>> Mar 29 11:33:11 eyes ntop[8471]:   endSample   ----------------------
>>>
>>>
>>>
>>>> Sounds like it's not receiving data - are you sure you've configured
>>>> it and activated it?
>>>>
>>>> If so, then you'll have to rebuild with the debug switch for sflow
>>>> and
>>>
>>>> see what's going on internally, but be prepared for a lot of output.
>>>>
>>>> -----Burton
>>>>
>>>> -----Original Message-----
>>>> From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On Behalf
>>>> Of gmourani at privalodc.com
>>>> Sent: Tuesday, March 29, 2005 9:57 AM
>>>> To: ntop at Unipi.IT
>>>> Cc: ntop at Unipi.IT
>>>> Subject: RE: [Ntop] sFlow not working!
>>>>
>>>> This doens't help, no trafic at all are seem. If I look inside the
>>>> sFlow plugin page, I can see this at the end of the page:
>>>>
>>>> Number of Flows with Bad Data 0
>>>> Total Number of Flows Processed 0
>>>>
>>>> The sFlow Interface Statistics appears correctly.
>>>> It's look like the plugins work and receive data from the switch but
>>>> Ntop doesn't procced them.
>>>>
>>>>> Check the back traffic - this has come up before - IIRC there are
>>>>> two
>>>
>>>>> kinds of sFlow packets, one is some sort of summary which ntop sees
>>>>> and ignores.
>>>>> So you may not really be getting data.  But I'm fuzzy on the
>>>>> details - google for it. Or check the FAQ and see if this makes
>>>>> sense:
>>>>>
>>>>> Q. sFlow doesn't work.
>>>>> A. Check this out:
>>>>>
>>>>>      This talks about a bad experience I had setting up sFlow
>>>>> reception. For
>>>>> the longest
>>>>>      time, I could see that ntop was getting sflow packets, but no
>>>>> data would show up.
>>>>>      It turns out the switch I was exporting from didn't see any
>>>>> real
>>>
>>>>> traffic, and it was
>>>>>      just sending COUNTERSAMPLE packets.....
>>>>>
>>>>>      - - - - - - - - I figured out that it was indeed "invalid"
>>>>> sflow
>>>
>>>>> packets.
>>>>>
>>>>>      Apparently, sflow sends COUNTERSAMPLE and FLOWSAMPLE packets.
>>>>> COUNTERSAMPLE packets
>>>>>      give a quick look at interface counters on the machine,
>>>>> whereas FLOWSAMPLE packets
>>>>>      are actual packet fragments from IP connections. Ntop seems to
>>>>> simply parse,
>>>>>      debug_print, and discard COUNTERSAMPLE packets...which made it
>>>>> confusing to look at
>>>>>      the debug output and say "wow, lots of sflow coming in!" when
>>>>> in
>>>
>>>>> fact it was just for
>>>>>      show, as Burton suggested. I added more switches (with active
>>>>> connections) to the
>>>>>      switches sending sflow packets and I now have hosts with
>>>>> pretty graphs.
>>>>>
>>>>>
>>>>>
>>>>> -----Burton
>>>>>
>>>>> -----Original Message-----
>>>>> From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On
>>>>> Behalf Of gmourani at privalodc.com
>>>>> Sent: Tuesday, March 29, 2005 8:14 AM
>>>>> To: ntop at Unipi.IT
>>>>> Subject: [Ntop] sFlow not working!
>>>>>
>>>>> Hello,
>>>>>
>>>>> I'm trying to activate sFlow with Ntop 3.1 and it's not working, no
>>>>> trafic visible. Here my config:
>>>>>
>>>>> sFlow version: 2.99
>>>>> Local Collector UDP Port: 6343
>>>>> Virtual sFlow Interface network Address: 172.16.0.0/255.255.0.0
>>>>>
>>>>> Flow Senders IP is: 172.16.2.251
>>>>> Flow Collector (Ntop) IP is: 172.16.1.215
>>>>>
>>>>> Thanks,
>>>>>
>>>>> _______________________________________________
>>>>> Ntop mailing list
>>>>> Ntop at unipi.it
>>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>>
>>>>> _______________________________________________
>>>>> Ntop mailing list
>>>>> Ntop at unipi.it
>>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> Ntop at unipi.it
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> Ntop at unipi.it
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop at unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>>
>>> **********************************************************************
>>> Confidential/Proprietary Note
>>>
>>> The information in this email is confidential and may be legally
>>> privileged.  Access to this email by anyone other than the intended
>>> addressee is unauthorized.  If you are not the intended recipient of
>>> this message, any review, disclosure, copying, distribution,
>>> retention, or any action taken or omitted to be taken in reliance on
>>> it is prohibited and may be unlawful.  If you are not the intended
>>> recipient, please reply to or forward a copy of this message to the
>>> sender and delete the message, any attachments, and any copies
>>> thereof from your system.  Thank you. Guardian Mortgage Documents,
>>> Inc. 225 Union Boulevard, Suite 200
>>> Lakewood, CO 80228.
>>> **********************************************************************
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop at unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop at unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop at unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>

More information about the Ntop mailing list