search

cloudflare / goflow

The high-scalability sFlow/NetFlow/IPFIX collector used internally at Cloudflare.
BSD 3-Clause "New" or "Revised" License
852 stars 171 forks source link

Renormalise the sampled data #102

Closed vishnubraj closed 3 years ago

vishnubraj commented 3 years ago

I am sending the goflow received data to a cloud-based Syslog server for analysis. I am sending a sampled NetFlow data from the router to gofow, does the goflow output a normalized NetFlow data or I need to apply any calculation to normalize it?

if yes, multiplying the bytes with the sampling rate is enough? What is the formula used for this?

lspgn commented 3 years ago

Hello, GoFlow does not do anything besides converting the data that is provided in the samples. You are provided with the sampling rate but you need to apply the normalization in your tools. Additionally, I believe most of the implementations are taking a per-packet per interface sampling. AFAIK there is no field that identify alternative methods of sampling (eg: sampling per distinct IP).

A simple case can be Bytes * SamplingRate

vishnubraj commented 3 years ago

Thanks for the clarification @lspgn !!