Subject: Traffic mismatches
From: Jason Lixfeld (jlixfeld@team.look.ca)
Date: Fri Dec 08 2000 - 16:50:23 CST
> I'm still trying to tweak what routers interfaces get flow switching > turned on on what interfaces. As a test I turned flow switching up on an > interface that's connected to a peer who I'm doing private peering with. > From this peer, I'm recieving the following AS': 11478, 16624, 5769 and > 7454. I've setup CampusIO.cf ASPairs for all of our local AS' (7271, 3812 > and 13705) and all of the AS' I'm receiving from this peer. I've setup > scripts to create the graphs. That script looks like this: > > /services/rrdtool/bin/rrdtool graph > /services/apache/htdocs/videotron.in.gif \ > 'DEF:1=/services/cflowd/data/flows/graphs/11478-13705.rrd:bytes:AVERAGE' \ > 'DEF:2=/services/cflowd/data/flows/graphs/11478-3812.rrd:bytes:AVERAGE' \ > 'DEF:3=/services/cflowd/data/flows/graphs/11478-7271.rrd:bytes:AVERAGE' \ > 'DEF:8=/services/cflowd/data/flows/graphs/14112-13705.rrd:bytes:AVERAGE' \ > 'DEF:9=/services/cflowd/data/flows/graphs/14112-3812.rrd:bytes:AVERAGE' \ > 'DEF:10=/services/cflowd/data/flows/graphs/14112-7271.rrd:bytes:AVERAGE' \ > 'DEF:11=/services/cflowd/data/flows/graphs/16624-13705.rrd:bytes:AVERAGE' > \ > 'DEF:12=/services/cflowd/data/flows/graphs/16624-3812.rrd:bytes:AVERAGE' \ > 'DEF:13=/services/cflowd/data/flows/graphs/16624-7271.rrd:bytes:AVERAGE' \ > 'DEF:19=/services/cflowd/data/flows/graphs/5769-13705.rrd:bytes:AVERAGE' \ > 'DEF:20=/services/cflowd/data/flows/graphs/5769-3812.rrd:bytes:AVERAGE' \ > 'DEF:21=/services/cflowd/data/flows/graphs/5769-7271.rrd:bytes:AVERAGE' \ > 'DEF:27=/services/cflowd/data/flows/graphs/7454-13705.rrd:bytes:AVERAGE' \ > 'DEF:28=/services/cflowd/data/flows/graphs/7454-3812.rrd:bytes:AVERAGE' \ > 'DEF:29=/services/cflowd/data/flows/graphs/7454-7271.rrd:bytes:AVERAGE' \ > 'AREA:1#0000FF:11478-13705.rrd AVERAGE bytes' \ > 'STACK:2#0000FF:11478-3812.rrd AVERAGE bytes' \ > 'STACK:3#0000FF:11478-7271.rrd AVERAGE bytes' \ > 'STACK:8#0000FF:14112-13705.rrd AVERAGE bytes' \ > 'STACK:9#0000FF:14112-3812.rrd AVERAGE bytes' \ > 'STACK:10#0000FF:14112-7271.rrd AVERAGE bytes' \ > 'STACK:11#0000FF:16624-13705.rrd AVERAGE bytes' \ > 'STACK:12#0000FF:16624-3812.rrd AVERAGE bytes' \ > 'STACK:13#0000FF:16624-7271.rrd AVERAGE bytes' \ > 'STACK:19#0000FF:5769-13705.rrd AVERAGE bytes' \ > 'STACK:20#0000FF:5769-3812.rrd AVERAGE bytes' \ > 'STACK:21#0000FF:5769-7271.rrd AVERAGE bytes' \ > 'STACK:27#0000FF:7454-13705.rrd AVERAGE bytes' \ > 'STACK:28#0000FF:7454-3812.rrd AVERAGE bytes' \ > 'STACK:29#0000FF:7454-7271.rrd AVERAGE bytes' > > For now, I'm not even going to concern myself with outbound traffic. Only > inbound because it's brain-dead simple. I configured flow switching on > the interface that connected to this private peer with. Now then, here's > where it gets interesting: I still have flow switching turned on on other > interfaces on other routers, but traffic from this private peer is coming > in ONLY from this particular connection. I draw up the rrdtools graph and > it shows that inbound, from this peer I'm recieving only 400,000 bits/sec. > I reload my MRTG graph for that particular interface and it shows that I'm > recieving almost 1.2megabits/sec. > > What could cause a 3 fold mismatch in what flowscan sees and what mrtg > sees? -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Fri Dec 08 2000 - 17:44:38 CST