Subject: Re: about Mcast
From: Dave Plonka (plonka@doit.wisc.edu)
Date: Wed Jun 27 2001 - 08:29:32 CDT
[I'm sending this reply to a personal email to the list and am Bcc'ing the sender...] On Tue, Jun 26, 2001 at 05:31:04PM -0400, someone wrote: > Hi Dave: > Sorry to write to you here,I forgot the e-mail for the mailing list to > ask question. The mailing list is address "flowscan@net.doit.wisc.edu". The pertinent info about the mailing lists is here: http://net.doit.wisc.edu/~plonka/FlowScan/#Mailing_Lists > Can you tell me what is the Mcast in Flowscan, It is the traffic reported in flows that had multicast destination addresses. > CDEF_TOTAL_in_bits = CDEF:TOTAL_in_bits=MCAST_in_bits,total_in_bits,+ > > why you calculate this way . If the source address of the multicast traffic is not local (as defined in "local_nets.boulder") then we count it is "inbound multicast" because otherwise the border router that exported the flow shouldn't have ever seen that traffic. > what 's the different between TOTAL and total. The capitalized "TOTAL" includes multicast, where as the lowercase "total" is just unicast traffic. (NetFlow currently isn't very good at accounting for multicast traffic since, although it is reported, it doesn't tell you whether or not the traffic was forwarded - and to which interface(s). For that reason, I tried to keep multicast and unicast totals seperate, except when the two appear on the same graphs.) Dave -- plonka@doit.wisc.edu http://net.doit.wisc.edu/~plonka ARS:N9HZF Madison, WI -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Wed Jun 27 2001 - 08:34:09 CDT