ntop/sflow sampling rate problem
Brought to you by:
cardigliano,
lderi
Menu
▾
▴
#45 ntop/sflow sampling rate problem
It seems like ntop and its sflow plugin have different understandings of the sampling rate value.
Sflow plugin extracts meanSkipCount value from the Sflow samples (configured on network equipment) and assigns its value to the sampling rate:
sflowPlugin.c: in static void handleSflowSample(SFSample *sample, int deviceId) function:
myGlobals.device[deviceId].samplingRate = sample->meanSkipCount;
Ntop uses this value X to skip X-1 data packets and to process just each X-th packet:
pbuf.c: in
void queuePacket(u_char *_deviceId,
const struct pcap_pkthdr *h,
const u_char *p)
function:
if(myGlobals.device[actDeviceId].samplingRate > 1) {
if(myGlobals.device[actDeviceId].droppedSamples < myGlobals.device[actDeviceId].samplingRate) {
myGlobals.device[actDeviceId].droppedSamples++;
return;
} else
myGlobals.device[actDeviceId].droppedSamples = 0;
}
This results in incorrect traffic amounts reported by ntop.
It would be great to make ntop and its sflow plugin to cooperate on this issue. :-)
Logged In: YES
user_id=2082275
Originator: YES
a dirty work around before the right solution arrives:
sflowPlugin.c:
in function static void handleSflowSample(SFSample *sample, int deviceId) :
* change queuePacket((u_char*)deviceId,&pkthdr,sample->header); to
int jip = 0;
for( ; jip < sample->meanSkipCount; jip ++ )queuePacket((u_char*)deviceId,&pkthdr,sample->header);
* change myGlobals.device[deviceId].samplingRate = sample->meanSkipCount; to
myGlobals.device[deviceId].samplingRate = 1;