![]() For example, a of 100 will cause nprobe to only export 1 flow out of 100 towards the downstream collector. This rate is effective when nprobe exports NetFlow towards a downstream collector, that is, when option -n is used. ![]() If the sampling rate is 100, a total of 2500 IN_BYTES will be accounted for that flow. ![]() For example, a flow with 250 IN_BYTES will be up-scaled by a factor equal to the sampling rate. The specified rate is only used to perform the upscaling. In this case, no actual sampling is performed on the incoming flows. This rate works when nprobe is in collector mode, that is, when option –collector-port is used and specifies the flow rate at which flows being collected have been sampled. This is particularly useful when incoming packets are already sampled on the capture device connected to nprobe but it is still meaningful to have up-scaled statistics. can be prepended with a to instruct nprobe to only use the sampling rate for the up-scaling, without performing any actual sampling. In the previous example, the size of the sampled packet will be multiplied by 100. All the statistics, including total bytes and packets, will be automatically up-scaled by nprobe to reflect the sample rate. For example, a sampling rate of 100 will instruct nprobe to actually process one packet out of 100, discarding all the others. This rate is effective for interfaces specified with -i and allows to control the sampling rate of incoming packets. Three different rates can be specified with this option: Further plugin available command line options.Note on interface indexes and (router) MAC/IP addresses.Handling Trillion Flows: Dumping Flows into ClickHouse.
0 Comments
Leave a Reply. |