[prev in list] [next in list] [prev in thread] [next in thread] 

List:       flowscan
Subject:    Re: Flowscan running properly, however, the Grapher doesn't show
From:       Mike <network () infinity77 ! net>
Date:       2005-02-17 17:54:44
Message-ID: 4214DA64.2050101 () infinity77 ! net
[Download RAW message or body]

It depends on how you are exporting the traffic from the router.
If you are using sampled flow like I do, you will have to edit the 
CUFlow.cf file to account for your sampling rate. Also, make sure you 
are exporting flows from every interface.

Wu, Anning wrote:
> To Whom It May Concern:
> 
>  
> 
> First of all, I am quite new to FlowScan, thus, I don’t know which email 
> address I should send regarding my question. Please correct me. Thanks.
> 
>  
> 
> My question is why Flow_Scan graph doesn’t show the appropriate traffic 
> amount for a quite busy router. The follow is my observations:
> 
>  
> 
> 1)     I am using RRD_Tools,Flow_Tools/Flow_Capture,Flow_Scan and CUFlow 
> to generate the graph and top_talker report. The Flow_Scan can properly 
> generate /var/netflow/ft/tmp_* file.
> 
> 2)     It looks like the server can receive data properly:
> 
> [root@Mercury ft]# tcpdump -n port 2055
> 
> tcpdump: listening on eth0
> 
> 09:13:28.218683 66.99.13.252.50941 > 10.50.9.7.2055: udp 1464
> 
> 09:13:28.218877 66.99.13.252.50941 > 10.50.9.7.2055: udp 1464
> 
> 09:13:28.219331 66.99.13.252.50941 > 10.50.9.7.2055: udp 1464
> 
> 09:13:28.219677 66.99.13.252.50941 > 10.50.9.7.2055: udp 1464
> 
> 09:13:28.220234 66.99.13.252.50941 > 10.50.9.7.2055: udp 1464
> 
> 09:13:28.220522 66.99.13.252.50941 > 10.50.9.7.2055: udp 1464
> 
>  
> 
> 3)     This is a very busy router. However, the graph shows that the 
> traffice is only < 2.0kb/second for bit report, similar with package and 
> flow reports. In the real world, the traffic should be at least 
> Mbits/second.
> 
> 4)     Why the server port 2055 can only receive udp1464 traffic, 
> without any other ports activities?
> 
>  
> 
> I am looking forward to hearing from you.
> 
>  
> 
> Thanks!
> 
>  
> 
> Anning Wu
> 
>  
> 
>            
> 



--
Help        mailto:majordomo@net.doit.wisc.edu and say "help" in message body
Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
"unsubscribe flowscan" in message body
Archive     http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
[prev in list] [next in list] [prev in thread] [next in thread]