Sampler Rate & Scaling

[Ramalama2]

Hi All :-)

1. Problem: (Scaling) Scaling doesn't work at all (--sample-rate with '@' or without makes no difference) ---> The Web-Interface have no scaling options too.

2. Problem: (Sampler Rate) Sampler Rate of 1, works but its far from optimal. ---> Sampler Rate of 512 causes wrong Traffic scaling in ntopng / nprobe

3. Problem (Duplicate Entrys) In the Dashboard Page all Hosts are different (good! no duplicates) BUT: The Traffic for some hosts is same, for example: ----> first and second entry (2 different hosts) show often same traffic speed... ----> The same happens for other hosts in that list too...

Background: We are using an Alcatel Lucent OS6900 Switch, with this Config:

SFLOW SAMPLER:
  Instance  Interface  Receiver   Rate   Sample-Header-Size
 ----------------------------------------------------------
    1      1/1/40          1        512          128

SFLOW POLLER:
 Instance  Interface  Receiver   Interval(Secs)
 ----------------------------------------------
    1        1/1/40        1          10

SFLOW RECEIVER:
 Receiver 1
 Name       = ntopng-srv
 Address    = IP_V4  172.XXX.XXX.XXX
 UDP Port   = 2055
 Timeout    = No Timeout
 Packet Size= 1400
 DatagramVer= 5

Ntopng Config:

-g=/var/tmp/ntopng.pid
-i="tcp://127.0.0.1:5121"
-i="tcp://127.0.0.1:6121"
--http-port=80
--https-port=443
--local-networks="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,2001:db8::/48"
--dns-mode=1
--online-license-check

Nprobe Config:

/etc/nprobe/nprobe-none.conf

--zmq="tcp://127.0.0.1:6121"
--collector-port=2055
--interface=none
--collector=none
-g=/run/ntopng_sfow.pid
--no-ipv6
--timestamp-format=2
--upscale-traffic
--online-license-check

We have a Promiscous-Interface too, to check sflow vs Promiscous... (The traffic is here different too)

/etc/nprobe/nprobe-ens192.conf

--zmq="tcp://127.0.0.1:5121"
-i=ens192
-n=none
-g=/run/ntopng_promc.pid
--no-ipv6
--timestamp-format=2
--upscale-traffic
--online-license-check

Cheers :-)

[simonemainardi]

Problem: (Scaling) Scaling doesn't work at all (--sample-rate with '@' or without makes no difference) ---> The Web-Interface have no scaling options too.

use --sample-rate on the Promiscous-Interface nprobe to equals the sample rate of your sflow agent. Sitll on the Promiscuos-Interface nprobe, remove --upscale-traffic that only affects sflow

Problem: (Sampler Rate) Sampler Rate of 1, works but its far from optimal. ---> Sampler Rate of 512 causes wrong Traffic scaling in ntopng / nprobe

what do you mean with wrong? please post the exact configurations used as in the current configurations posted there's no sample rate at all

Problem (Duplicate Entrys) In the Dashboard Page all Hosts are different (good! no duplicates) BUT: The Traffic for some hosts is same, for example: ----> first and second entry (2 different hosts) show often same traffic speed... ----> The same happens for other hosts in that list too...

this is not clear please try to explain further and add screenshots.

also make sure to use the latest dev versions of nprobe and ntopng

[simonemainardi]

@Ramalama2 any news? can you provide the information requested?

[simonemainardi]

closing for inactivity, reopen providing the requested information in necessary