Subject: Re: How to improve flow hit ratio?
From: Matt Selsky (selsky@columbia.edu)
Date: Mon Oct 23 2006 - 20:20:00 CDT
On Oct 20, 2006, at 2:36 PM, Phelps, David A CIV DMDC wrote: > On one router I have a flow hit ratio of about 350/500 on average. > While this is good, it is not good enough. On another I have a > miserable 60/30,000 flow hit ratio. I am confident that I have the > right subnetting on the first router (so the other 150 flows would > be suboptimal intranet traffic?), but I am currently double > checking the subnet configuration on the second one. Our hit ratios are above 99%. > Is there another way (other than subnetting or interface indexes) > to improve flow hit ratios? CUFlow only uses the Subnet statements. If you have a lot of transit traffic, with neither source not destination being part of the Subnets, then that would explain the low hit ratio. > Is there a way to have the flow hit ratio display on the graph (so > that I know how accurate my graph is)? CUGrapher doesn't currently have this feature. The ratio is only recorded in flowscan.log and the grapher would have to match a ratio from a specific time period with some lines in the log file. > Better yet, is there a way to have the perl modules just ignore > what traffic is in and out altogether? A flowscan mailing list > archive mention something about changing return values from 0 to 1. CUFlow is designed for edge networks, so it is important for it to detect transit traffic and ignore it. Is the network you are monitoring a transit network or an edge network? There are other modules that are meant for transit networks, like CarrierIn or JKFlow. -- Matt -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Mon Oct 23 2006 - 20:23:49 CDT