On 06/13/2009 05:11:40 AM, Paolo Lucente wrote:
Hi Chris,
Aguri is slightly more limited in the fact it has only a set of (4?) traffic aggregation profiles whereas pmacct offers a wider range of primitives. But I guess the point you wanted to make was the dynamic variation of the sampling rate under increased traffic load (ie. DDoS). pmacct actually does have such feature only available to the SQL plugins: it's part of the SQL preprocess infrastructure (look for 'sql_preprocess' in the CONFIG-KEYS document or the wiki) and is called 'fsrc' (Flow Sampling under Resource Constraints). It is an implementation i did years ago loosely based on a paper coming from AT&T Labs. It aims at offering to the SQL database a sort of stream-lined number of aggregates; aggregates are weighted, ranked and sampled based on probability (which gives the dynamic/adaptive part of the approach); the resource constraint is expressed via the number of flows you want to end in the database (which is in turn seen as the constrained resource here).
What really is the constrained resource here? Is it the number of transactions the database supports or is it something more fundamental to the pmacct performance like cpu or memory constraints? What I'm thinking is that past a certain point having the system do more work to detect that it's under load becomes counter-productive. Is that why you've not implemented such a feature for the in-memory tables or is it simply because it's up to the pmacct command to determine sample frequency? Just curious. Regards, Karl <[email protected]> Free Software: "You don't pay back, you pay forward." -- Robert A. Heinlein _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
