Re: Kentik nprobes sampling reporting excessive packets

Jesse,
I have modified this but I have forgot to reply, my fault.

Please download the latest nprobe and it will work. In the new release
traffic upscale (i.e. x 160 multiplication) is not performed unless you
use --upscale-traffic

Regards Luca

On 03/28/2017 01:54 PM, Jesse Alexander wrote:
>
> Good morning (depending on where you are),
>
>  
>
> We are still waiting for a response to this.  Is this a known issue,
> or am I doing something wrong?  Or has there been an update with a fix?
>
>  
>
> Kind regards,
>
>  
>
> Jesse
>
>  
>
> *From:*[email protected]
> [mailto:[email protected]] *On Behalf Of *Jesse Alexander
> *Sent:* Monday, March 06, 2017 11:55 AM
> *To:* [email protected]
> *Subject:* [Ntop] Kentik nprobes sampling reporting excessive packets
>
>  
>
> Hello,
>
>  
>
> We are using the version of nprobe to work with Kentik (nprobes) and
> we are seeing packets being reported incorrectly when using sampling.
>
>  
>
> $sudo nprobe -v
>
> Welcome to nProbe v.7.5.170306 (r5675) for x86_64-unknown-linux-gnu
>
> Copyright 2002-17 ntop.org
>
> Build OS:      CentOS release 6.8 (Final)
>
>  
>
> Example script being used:
>
> -q=A.A.A.A:6650
>
> -n=X.X.X.X:9995
>
> -n=Y.Y.Y.Y:2056
>
> -V=5
>
> -a=
>
> -i=myri1-1
>
> -S=160:1
>
> -t=60
>
> --if-networks=@/etc/cento/networks
>
> -b=1
>
> -Q=1
>
> -u=1
>
> --dump-stats=/var/log/nprobe/myri1-1-0_flows_stats.txt
>
>  
>
> With the above, when I perform a controlled bandwidth test using a
> traffic generator, the packets per second being reported to Kentik is
> roughly 350K.  The traffic generator is sending 2140pps of udp packets
> with 1460 byte payloads at a payload rate of 25 Mbps, so 25.9 Mbps
> with IP header.
>
>  
>
> We also sent the same data to another collector at the same time, and
> we saw exact same issue in the nfacctd data.
>
>  
>
> We saw that when we changed the sample rate, the pps was multiplied by
> that value, so in this case 160x (2140x160=342,400).
>
>  
>
>  
>
>  
>
>  
>
>  
>
> This is also evident in the attached png image of wireshark output
> from a captured packet.
>
>  
>
>  
>
> Can you please advise if this is a bug, and if so, the best course of
> action (use a previous version?), or if I am doing something wrong.
>
>  
>
> I also attached the images in case they are stripped out.
>
>  
>
> Kind regards,
>
>  
>
> Jesse
>
>  
>
>  
>
>
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop