search

pavel-odintsov / fastnetmon

FastNetMon - very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
https://fastnetmon.com
GNU General Public License v2.0
3.41k stars 565 forks source link

Incorrect Data Display #452

Closed ghost closed 7 years ago

ghost commented 8 years ago

Hello, The data displayed by importing Netflow data from a Cisco x4500 is showing slow and incorrect for each ip address.

Also the data for sflow is also showing incorrect as it shows as divided by 10.

pavel-odintsov commented 8 years ago

Hello!

Do you use netflow sampling?

Do you know about this option in configuration file:

# Netflow v9 and IPFIX agents use different and very complex approaches for notifying about sample ratio
# Here you could specify a sampling ratio for all this agents
# For NetFLOW v5 we extract sampling ratio from packets directely and this option not used
netflow_sampling_ratio = 1
ghost commented 8 years ago

Hello,

I am using netflow sampling. I have used netflow sampling ratio too which helps me make the netflow data accurate.

When i use sflow data, it has no sampling option in config.

Also I checked if data being displayed is real time and accurate but that too had problems as the data that was displayed locally was some value which was higher than what was showing in fastnetmon. Also the data gets displayed after nearly a minute or so. Is there some setting I am missing ?

pavel-odintsov commented 8 years ago

Hello!

So I actually do not know any issues with sFLOW. But please share your sampling ratio because it's very important for data accuracy http://blog.sflow.com/2009/06/sampling-rates.html

Will be fine if you enable InfluxDB or Graphite graphing and we will check issue visually: https://github.com/pavel-odintsov/fastnetmon/blob/master/docs/GRAPHITE_INTEGRATION.md

pavel-odintsov commented 7 years ago

This issue needs details for investigation. Feel free to open ticket and provide details.