Mailing List Archive: Cento - Is it possible to send sampled rate

Cento - Is it possible to send sampled rate

Feb 28, 2017, 9:49 AM

Post #1 of 7 (689 views)

Hello,

We are using Cento to send netflow to a system that requires us to send at a sampled rate. Is this possible with Cento? I do not see the option listed in the Cento help file.

I see it is possible with nprobe:

[--sample-rate|-S] <pkt rate>:<flow rate>
| Packet capture sampling rate and flow
| sampling rate. If <pkt rate> starts with
| '@' it means that nprobe will report
| the specified sampling rate but will
| not sample itself as incoming packets
| are already sampled on the specified
| capture device at the specified rate.
| Default: 1:1 [no sampling]

If so, can we define a sampled rate for one collector and not sampled to another collector?

Kind regards,

Jesse

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: Cento - Is it possible to send sampled rate [ In reply to ]

mainardi at ntop

Mar 3, 2017, 2:14 AM

Post #2 of 7 (686 views)

Permalink

Jesse,

What would you have to send to the collectors? Sampled flows (e.g., one out
of ten flows)? Or do you have to sample packets before sending the flows?

However, sampling is not currently implemented in cento so please file a
feature request in https://github.com/ntop/nProbe and try to explain in
detail what is your goal

Regards,
Simone

Simone

On Tue, Feb 28, 2017 at 6:49 PM, Jesse Alexander <jessea@datafoundry.com>
wrote:

> Hello,
>
> We are using Cento to send netflow to a system that requires us to send at
> a sampled rate. Is this possible with Cento? I do not see the option
> listed in the Cento help file.
>
> I see it is possible with nprobe:
>
> [--sample-rate|-S] <pkt rate>:<flow rate>
> | Packet capture sampling rate and flow
> | sampling rate. If <pkt rate> starts with
> | '@' it means that nprobe will report
> | the specified sampling rate but will
> | not sample itself as incoming packets
> | are already sampled on the specified
> | capture device at the specified rate.
> | Default: 1:1 [no sampling]
>
> If so, can we define a sampled rate for one collector and not sampled to
> another collector?
>
> Kind regards,
>
> Jesse
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>

Re: Cento - Is it possible to send sampled rate [ In reply to ]

mainardi at ntop

Mar 3, 2017, 2:14 AM

Post #3 of 7 (686 views)

Permalink

Re: Cento - Is it possible to send sampled rate [ In reply to ]

deri at ntop

Mar 6, 2017, 2:56 PM

Post #4 of 7 (684 views)

Permalink

Alexander
in cento we currently support no sampling as the idea is to capture everything, but I will implement -S as it makes sense in some cases

Regards Luca

> On 28 Feb 2017, at 18:49, Jesse Alexander <jessea@datafoundry.com> wrote:
>
> Hello,
>
> We are using Cento to send netflow to a system that requires us to send at a sampled rate. Is this possible with Cento? I do not see the option listed in the Cento help file.
>
> I see it is possible with nprobe:
>
> [--sample-rate|-S] <pkt rate>:<flow rate>
> | Packet capture sampling rate and flow
> | sampling rate. If <pkt rate> starts with
> | '@' it means that nprobe will report
> | the specified sampling rate but will
> | not sample itself as incoming packets
> | are already sampled on the specified
> | capture device at the specified rate.
> | Default: 1:1 [no sampling]
>
> If so, can we define a sampled rate for one collector and not sampled to another collector?
>
> Kind regards,
>
> Jesse
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: Cento - Is it possible to send sampled rate [ In reply to ]

deri at ntop

Mar 6, 2017, 2:56 PM

Post #5 of 7 (684 views)

Permalink

Re: Cento - Is it possible to send sampled rate [ In reply to ]

jessea at datafoundry

Mar 6, 2017, 9:31 PM

Post #6 of 7 (678 views)

Permalink

Luca,

Thank you very much!!!! Can you please let me know when it is available?

Warm regards,

Jesse

-----Original Message-----
From: ntop-bounces@listgateway.unipi.it [mailto:ntop-bounces@listgateway.unipi.it] On Behalf Of Luca Deri
Sent: Monday, March 06, 2017 4:57 PM
To: ntop@unipi.it
Cc: ntop@listgateway.unipi.it
Subject: Re: [Ntop] Cento - Is it possible to send sampled rate

Alexander
in cento we currently support no sampling as the idea is to capture everything, but I will implement -S as it makes sense in some cases

Regards Luca

> On 28 Feb 2017, at 18:49, Jesse Alexander <jessea@datafoundry.com> wrote:
>
> Hello,
>
> We are using Cento to send netflow to a system that requires us to send at a sampled rate. Is this possible with Cento? I do not see the option listed in the Cento help file.
>
> I see it is possible with nprobe:
>
> [--sample-rate|-S] <pkt rate>:<flow rate>
> | Packet capture sampling rate and flow
> | sampling rate. If <pkt rate> starts with
> | '@' it means that nprobe will report
> | the specified sampling rate but will
> | not sample itself as incoming packets
> | are already sampled on the specified
> | capture device at the specified rate.
> | Default: 1:1 [no sampling]
>
> If so, can we define a sampled rate for one collector and not sampled to another collector?
>
> Kind regards,
>
> Jesse
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop