On Fri, 2011-04-29 at 07:56 -0700, Rick Jones wrote:
> On Fri, 2011-04-29 at 07:42 -0500, Gary Gatten wrote:
> > Good morning,
> >
> > First I would point out that a 10G interface might only be 2G of
> > throughput, or less - who knows. You also may want to consider netflow
> > or sflow which will dramatically decrease the processing requirements
> > over full packet capture and most likely meet your requirements.
>
> There is (IMO) at least one small bug in the sFlow plugin for ntop - the
> "topValue" that is used to calculate the maximum value passed-in on RRD
> creation is based on 1 GbE.
>
> 40 GbE interfaces are now appearing on switches, and I believe they can
> be trunked. It may be time for that topValue to just fade away.
Actually, I got that a bit wrong - it isn't in the sflow plugin, it is
in the rrd plugin (4.0.3):
unsigned long topValue;
rrdDumpInterval = short_step ? (2*dumpShortInterval) :
dumpInterval;
step = rrdDumpInterval;
topValue = 1000000000 /* 1 Gbit/s */;
if(strstr(key, "throughput")) {
; /* Nothing to do as throughput is saved in Mbps */
} else if(strncmp(key, "pkt", 3) == 0) {
topValue /= 8*64 /* 64 bytes is the shortest packet we care of */;
} else {
topValue /= 8 /* 8 bytes */;
}
So, presumably it will affect more than just sFlow stats.
rick jones
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
