Mailing List Archive: question about nprobe/ntopng sampling rate/scaling factor

question about nprobe/ntopng sampling rate/scaling factor

Feb 28, 2017, 5:14 AM

Post #1 of 3 (594 views)

Hi,
I have this kind of configuration

switches - erspan - [ Centos, nprobe --zmq-- ntopng]

Everything is quiet good, but I dont understand scaling configuration.

I have sampling rate 1/10 (on a swithces side)

I set sampling rate to 10 for that nprobe interface
but still have 1/10 bandwidth statistics everywhere

Version: 2.5.170220 - Pro Small Business Edition

Best,
Michail

Re: question about nprobe/ntopng sampling rate/scaling factor [ In reply to ]

mainardi at ntop

Mar 3, 2017, 2:09 AM

Post #2 of 3 (591 views)

Permalink

Hi,

You should use use option --sample-rate with '@' as you want nprobe to
rescale statistics from sampled packets but not to sample itself. In your
case this should work:

--sample-rate @10:1

See the help:

[--sample-rate|-S] <pkt rate>:<flow rate>
| Packet capture sampling rate and flow
| sampling rate. If <pkt rate> starts
with
| '@' it means that nprobe will report
| the specified sampling rate but will
| not sample itself as incoming packets
| are already sampled on the specified
| capture device at the specified rate.

Simone

On Tue, Feb 28, 2017 at 2:14 PM, Mikhael Chernogorsky <
mikhaelc@infinidat.com> wrote:

> Hi,
> I have this kind of configuration
>
> switches - erspan - [ Centos, nprobe --zmq-- ntopng]
>
> Everything is quiet good, but I dont understand scaling configuration.
>
> I have sampling rate 1/10 (on a swithces side)
>
> I set sampling rate to 10 for that nprobe interface
> but still have 1/10 bandwidth statistics everywhere
>
>
> Version: 2.5.170220 - Pro Small Business Edition
>
> Best,
> Michail
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>