Collection and Analysis of Statistics by Protocols and Directions

Product Description

There are no network losses between SSG and the collector. For example, check if the traffic from the control channel to the collector passes through shaping or if there are interface limitations below the Netflow output speed of SSG.

Ensure that the collector can accept data at the SSG output speed. Use the netflow_rate_limit parameter to limit the speed; for diagnostic purposes, you can set the Netflow SSG output speed to minimum values. If there are no issues at minimal values, the losses are on the collector level.

grep "Sequence Errors" /var/log/messages|grep -v "Sequence Errors: 0"

Set the netflow_rate_limit parameter according to the information flow and collector capabilities. If set too low, losses will occur for another reason — not all information will be sent in time.

Tuning the network stack

Install nfsen on a more powerful computer, avoid virtualization.

Switch to the TCP version of the IPFIX (Netflow) protocol.

statisticsvar/log/dpi/fastdpi_stat.log

[STAT ][2019/02/01-17:21:28:938274] Statistics on NFLW_Full : {0/0/1668468} NFLW_Full_IPv4{3948181/939339852}{3111140/3415836963}{7760/13036/6640} The first 3 digits - {0/0/1668468} : { connect errors/flow released/nothing to send - packet counters unchanged } NFLW_Full_IPv4{3948181/939339852}{3111140/3415836963}{7760/13036/6640} : {3948181/939339852} : packets/bytes for direction = 0 ( ip_src < ip_dst ) {3111140/3415836963} : packets/bytes for direction = 1 {7760/13036/6640} : not sent by full netflow/ipfix - number of flows/packets direction==0/packets direction==1

NFLW_Full_IPv6

1

netflow_timeout
t1t2

by ports

by AS

by billing

by sessions. Session changes are sent considering active and passive timeouts.

tnt2t2tn

netflow_timeout==1
SSGMB

Attention:

netflow_timeout10netflow_rate_limit=10

nfdump -R /usr/local/nfsen/profiles-data/live/petrosviaz/2015/07/20 -s dpipr/bytes -n 50 |grep "(" |awk -v FIELDWIDTHS='40 40 28 16' -v OFS=';' '{print $2,$4 }'|tr -d '[:blank:]'
nfdump -R /usr/local/nfsen/profiles-data/live/petrosviaz_as/2015/07/20 -s asn/bytes -n 50 |grep "(" |awk -v FIELDWIDTHS='38 65 28 16' -v OFS=';' '{print $2,$4 }'|tr -d '[:blank:]'
nfdump -R /usr/local/nfsen/profiles-data/live/protocols/2015/07/20 -s dpipr/bytes -n 50 |grep "(" |awk -v FIELDWIDTHS='40 40 28 16' -v OFS=';' '{print $2,$4 }'|tr -d '[:blank:]' > top_proto.csv
nfdump -R /usr/local/nfsen/profiles-data/live/directions/2015/07/20 -s asn/bytes -n 50 |grep "(" |awk -v FIELDWIDTHS='38 65 28 16' -v OFS=';' '{print $2,$4 }'|tr -d '[:blank:]' > top_asn.csv

Attention:
-s dpipr/bytes-o-o fmt:"%ts %td %pr %sap → %dap %flg %tos %pkt %byt %fl"