Hi Robert, On Thu, Jan 26, 2017 at 5:35 PM, Robert Williams <[email protected]> wrote:
> Hi Simone, > > > > Many thanks for that! All sorted now, although I can’t see it in my > documentation here unless I’ve got an old version of the docs perhaps? > Actually the latest nProbe User Guide contain that option so very likely you have an outdated guide. Regards, Simone > > Cheers!! > > > > *From:* [email protected] [mailto:ntop-bounces@ > listgateway.unipi.it] *On Behalf Of *Simone Mainardi > *Sent:* 26 January 2017 14:44 > *To:* [email protected] > *Subject:* Re: [Ntop] Sampling factor for Flows > > > > Robert, > > > > See option > > > > [--collector-sample-rate] <value> | Specify the bytes/pkts collection > sample rate (NetFlow only). > > > > > > Regards, > > Simone > > > > On Thu, Jan 26, 2017 at 1:09 PM, Robert Williams <[email protected]> > wrote: > > Hi, > > I’ve just bought a license for nprobe so I can test without the 25k flow > limit, the setup is simple: > > [Cisco] -> Netflow V9 -> [nprobe] -> zmq -> [ntopng] > > The Cisco uses 1 in 20 sampling for Netflow, but I can’t seem to find > where to inform nprobe (or ntopng) of this sampling? The result of this is > that all data in ntopng is shown as 1/20th of real rates. > > One of the other programs we use to analyse Netflow data here has a > parameter for it, which is: > > netflow_sampling_ratio = 20 > > So that it knows to 'upscale' the flow data, essentially, I’m just looking > for this parameter in nprobe/ntopng. > > The only one I found is within nprobe and looks like this: > > [--sample-rate|-S] : <pkt rate>:<flow rate> > | Packet capture sampling rate and flow > | sampling rate. If starts with > | '@' it means that nprobe will report > | the specified sampling rate but will > | not sample itself as incoming packets > | are already sampled on the specified > | capture device at the specified rate. > | Default: 1:1 [no sampling] > > However – this doesn’t seem to let me configure a sampling rate for flows > for ‘reporting only’. Just a sample ratio for mirrored traffic, which of > course I’m not using. > > Any input welcome - Cheers! > > ROBERT WILLIAMS > TECHNICAL DIRECTOR > > Custodian Data Centres > Tel: +44 (0) 1622 230382 <+44%201622%20230382> || E-Mail: mailto: > [email protected] > http://www.CustodianDC.com > > Disclaimer: https://www.CustodianDC.com/email-disclaimer > Registered Office: Vinters Business Park, New Cut Rd, Maidstone, ME14 5NZ. > Company Number: 07878023 > > > > > > [image: Custodian Data Centres] <https://www.custodiandc.com> > Robert Williams > Technical Director > Custodian Data Centres > T: +44 (0) 1622 230382 <+44%201622%20230382> > E: [email protected] W: www.CustodianDC.com > <https://www.custodiandc.com> > *ISO 27001 Certified - 100% Uptime* > Data Floor 4 Launch - 2nd Feb 2017 - Book Now > <https://www.custodiandc.com/DF4-launch-booking> > > Registered Office: Vinters Business Park, New Cut Rd, Maidstone, Kent ME14 > 5NZ Company Number 07878023 > Click here to view our email disclaimer > <https://www.custodiandc.com/email-disclaimer> > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop >
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
