[netflow-tools] softflowd -m 512000 ... flow-capture ... 90 % less traffic??
Andrew McGill
list2009 at lunch.za.net
Tue Aug 25 20:35:14 EST 2009
On Friday 14 August 2009 10:09:35 Sebastian Majkowski wrote:
> Andrew McGill wrote:
> > Greetings netflow-tools,
> >
> > I have softflowd sending information to flow-capture for a network with a
> > few hundred hosts (don't ask, the answer is probably "yes"). Softflowd
> > was configured with the default without a -m parameter, so that softflowd
> > tracked a maximum of 8192 flows. The primary reason for rolling over
> > flows was running out of connections - and cpu load was obnoxiously high.
> > So I fixed it (in the sense of thereifixedit.com, perhaps). I told
> > softflowd that it should track a maximum of 512000 flows, and it duly
> > did.
> >
> > The before and after log files for 10 minutes of traffic look like this:
> >
> > -rw-r--r-- 1 root root 12678211 Jul 26 17:02
> > ft-v05.2009-07-26.165257+0200 -rw-r--r-- 1 root root 673952 Jul 26
> > 17:32 ft-v05.2009-07-26.172247+0200
> >
> > ... which is great, BUT it seems that most of the traffic is getting
> > lost. It's not that this traffic is getting deferred into later stats --
> > it simply never gets reported -- the reported totals dropped to 10% of
> > their previous values!
> >
> > before: Average Kbits / second (real) : 49598.9333
> > after: Average Kbits / second (real) : 3872.6817
> >
> > The next day it was still roughly 10% of the real amount:
> >
> > Average Kbits / second (real) : 4617.1089
> >
> > Is this correct behaviour? Am I doing one or more things wrong?
> >
> > &:-)
> >
> >
> >
> > Notes:
> >
> > Startup parameters:
> > flow-capture -p /var/run/flow-capture.pid -n 144 -N -1 \
> > -w /var/log/netflows -S 10 0/0/8828
> >
> > softflowd -i eth2 -n 127.0.0.1:8828 # BEFORE
> > softflowd -i eth2 -n 127.0.0.1:8828 -m 512000 # AFTER
> >
> >
> > In case it's relevant, this is what flow-stat said about the files:
> >
> >
> > # --- ---- ---- Report Information --- --- --- (BEFORE)
> > #
> > # Fields: Total
> > # Symbols: Disabled
> > # Sorting: None
> > # Name: Overall Summary
> > #
> > # Args: flow-stat
> > #
> > Total Flows : 723704
> > Total Octets : 2975935893
> > Total Packets : 6138299
> > Total Time (1/1000 secs) (flows): 5790296389
> > Duration of data (realtime) : 480
> > Duration of data (1/1000 secs) : 2363291
> > Average flow time (1/1000 secs) : 8000.9183
> > Average packet size (octets) : 484.8144
> > Average flow size (octets) : 4112.0900
> > Average packets per flow : 8.4818
> > Average flows / second (flow) : 306.2649
> > Average flows / second (real) : 1507.7167
> > Average Kbits / second (flow) : 10075.1113
> > Average Kbits / second (real) : 49598.9333
> >
> >
> > IP packet size distribution:
> > 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448
> > 480 .000 .379 .286 .090 .082 .044 .024 .021 .013 .007 .005 .003 .003 .001
> > .002
> >
> > 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
> > .003 .005 .001 .014 .018 .000 .000 .000 .000 .000 .000
> >
> > Packets per flow distribution:
> > 1 2 4 8 12 16 20 24 28 32 36 40 44 48
> > 52 .643 .086 .075 .097 .030 .018 .011 .007 .005 .004 .003 .002 .002 .002
> > .001
> >
> > 60 100 200 300 400 500 600 700 800 900 >900
> > .002 .005 .003 .001 .001 .000 .000 .000 .000 .000 .001
> >
> > Octets per flow distribution:
> > 32 64 128 256 512 1280 2048 2816 3584 4352 5120 5888 6656 7424
> > 8192 .000 .241 .298 .191 .104 .082 .022 .011 .007 .004 .004 .002 .002
> > .002 .002
> >
> > 8960 9728 10496 11264 12032 12800 13568 14336 15104 15872 >15872
> > .001 .001 .001 .001 .001 .001 .001 .001 .001 .001 .019
> >
> > Flow time distribution:
> > 10 50 100 200 500 1000 2000 3000 4000 5000 6000 7000 8000 9000
> > 10000 .733 .014 .013 .024 .035 .032 .025 .017 .010 .008 .016 .007 .005
> > .005 .004
> >
> > 12000 14000 16000 18000 20000 22000 24000 26000 28000 30000 >30000
> > .006 .004 .003 .003 .002 .004 .002 .001 .001 .001 .023
> >
> > # --- ---- ---- Report Information --- --- --- (AFTER)
> > #
> > # Fields: Total
> > # Symbols: Disabled
> > # Sorting: None
> > # Name: Overall Summary
> > #
> > # Args: flow-stat
> > #
> > Total Flows : 50516
> > Total Octets : 261406012
> > Total Packets : 551158
> > Total Time (1/1000 secs) (flows): 329152148
> > Duration of data (realtime) : 540
> > Duration of data (1/1000 secs) : 1366814
> > Average flow time (1/1000 secs) : 6515.8001
> > Average packet size (octets) : 474.2851
> > Average flow size (octets) : 5174.7172
> > Average packets per flow : 10.9106
> > Average flows / second (flow) : 36.9810
> > Average flows / second (real) : 93.5481
> > Average Kbits / second (flow) : 1530.9283
> > Average Kbits / second (real) : 3872.6817
> >
> >
> > IP packet size distribution:
> > 1-32 64 96 128 160 192 224 256 288 320 352 384 416 448
> > 480 .000 .205 .364 .125 .116 .053 .028 .020 .019 .009 .005 .004 .003 .002
> > .002
> >
> > 512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
> > .003 .008 .001 .015 .019 .000 .000 .000 .000 .000 .000
> >
> > Packets per flow distribution:
> > 1 2 4 8 12 16 20 24 28 32 36 40 44 48
> > 52 .439 .174 .073 .119 .067 .034 .018 .015 .010 .008 .006 .004 .003 .004
> > .002
> >
> > 60 100 200 300 400 500 600 700 800 900 >900
> > .004 .010 .005 .001 .001 .000 .000 .000 .000 .000 .001
> >
> > Octets per flow distribution:
> > 32 64 128 256 512 1280 2048 2816 3584 4352 5120 5888 6656 7424
> > 8192 .000 .059 .297 .200 .153 .154 .042 .022 .011 .006 .004 .003 .002
> > .004 .003
> >
> > 8960 9728 10496 11264 12032 12800 13568 14336 15104 15872 >15872
> > .002 .002 .002 .001 .001 .001 .001 .001 .001 .000 .027
> >
> > Flow time distribution:
> > 10 50 100 200 500 1000 2000 3000 4000 5000 6000 7000 8000 9000
> > 10000 .298 .024 .012 .073 .319 .071 .035 .024 .012 .010 .020 .009 .007
> > .006 .005
> >
> > 12000 14000 16000 18000 20000 22000 24000 26000 28000 30000 >30000
> > .009 .005 .003 .004 .004 .003 .003 .003 .003 .004 .035
> >
> >
> >
> >
> > _______________________________________________
> > netflow-tools mailing list
> > netflow-tools at mindrot.org
> > https://lists.mindrot.org/mailman/listinfo/netflow-tools
>
> Hi Andrew,
>
> I am not an expert in net-flow but I had similar situation. I guess that
> this is the result of increasing max flows tracked - so less frequently
> netflow records will be created (and smaller file). When maximum 8192
> flows was reached probably softflowd just ends some flows creating
> records to manage other flows, thats why the file is bigger. The same
> situation is when manipulating timers - this allows you to decide when
> (or how long) the flow is tracked before creating netflow record...
Well, I have worked around the problem by using a smaller connection buffer,
and setting a timeout of 59 seconds for anything to make sure that something
gets logged:
/usr/local/sbin/softflowd -i eth0 -n 127.0.0.1:8818 -m 65536 -t maxlife=59 -t
general=59
Flows over 1 minutes -- well, that's just tough. We'll count it as multiple
flows.
> Maybe it would be good to trace some connections from one of you users
> to see how they are placed in netflow records - this will prove if the
> data is tracked or not (as you suspect)
like a regression test ... hmm.. Yes, a good idea .. hmm. I wonder what the
correct test is ... something like this ?
dd if=/dev/zero bs=1024 count=10 | netcat somewhere.com 80
expect a flow of ... um ? 10 kb plus a bit? (it's a touchy-feely test ...)
&:-)
More information about the netflow-tools
mailing list