Open source Netflow analysis for monitoring AS-to-AS traffic

Sun Mar 31 09:53:11 UTC 2024

Hi Peter,

Thanks for that link. I did read the spec, and while the definition itself is clear, the escape clause gives a lot of wiggle room:

"Hardware limitations may prevent an exact reporting of the underlying frame length, but an agent should attempt to be as accurate as possible."

I read that as, "the vendor will do whatever it pleases, and you should be grateful to receive a non-negative integer at all." I could be too cynical, though.

Anyway, this particular vendor does other funny things (such as sometimes stripping the q-tag headers from the sampled frame; throttling the frame sampling on the box, but not adjusting the sampling interval in the sFlow exports) that make it a true joy to work with this gear. ;-)

Cheers,

-- Steven
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20240331/2e05d991/attachment.html>