Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been attempting to monitor sFlow traffic from some F5 LTMs, but I'm getting figures like 9 terabytes of data over http, which I don't believe we are getting. Has anyone else had issues like this when monitoring flows with CA NFA ?

share|improve this question
    
9TB over what time period? –  EEAA Oct 15 '13 at 2:15
    
time period of 24 hours. –  Lawrence Oct 15 '13 at 7:22

1 Answer 1

I'm not familiar with that particular tool, but this sounds like the sFlow sample rate is being misreported or misapplied. Essentially: sFlow samples every N packets, and then the collector multiplies by that number to estimate the true volume. If you're getting every 10 packets and the collector thinks you're getting every 100 packets, though, you can see errors like this.

If you can, see if you can download a single file of known size from an IP address that isn't commonly accessed from your network. Track down that flow and compare the reported size to the actual file size. (There will always be errors -- this is estimation -- just look to the difference in magnitude)

share|improve this answer
    
Thanks, I'll try that out. –  Lawrence Oct 15 '13 at 23:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.