You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Our Juniper MX router installed a jflow card to capture 1:1 netflow and send to nfdump 1.6.12. After first few minutes (about 2 to 5 minutes), the "Packets" and "Bytes" counts of the flow records are multiplied by 2, e.g. from "1 packet 40 bytes" to "2 packets 80 bytes". tcpdump confirm the traffic were multiplied.
Since the change occurred after few minutes, many "template" packets has been received. I think the sampling rate change would not be due to sampling rate reported. Please correct me if I was wrong.
The problem can be workaround by enforce nfcapd sampling rate (with parameter -s -1).
Below is the nfdump output showing first 11 lines of correct dump while lines after are multiplied by 2.
Actually it looks to e as your device announces a sampling rate after a few minutes, which is not correct.
nfcapd keeps sampling rate 1 unless otherwise announced or overwritten by -s -(n)
Our Juniper MX router installed a jflow card to capture 1:1 netflow and send to nfdump 1.6.12. After first few minutes (about 2 to 5 minutes), the "Packets" and "Bytes" counts of the flow records are multiplied by 2, e.g. from "1 packet 40 bytes" to "2 packets 80 bytes". tcpdump confirm the traffic were multiplied.
Since the change occurred after few minutes, many "template" packets has been received. I think the sampling rate change would not be due to sampling rate reported. Please correct me if I was wrong.
The problem can be workaround by enforce nfcapd sampling rate (with parameter -s -1).
Below is the nfdump output showing first 11 lines of correct dump while lines after are multiplied by 2.
The text was updated successfully, but these errors were encountered: