Hi. I added some code to flowd-reader. Is any one interested in being able to do this ? (inspired by flow-tools flow-stat). I found it helpful for debugging etc. It would be great to know how other people use flowd to gather statistics etc. flowd-reader -s flowd-2011-12-07-030500 Flow Statistics IPv4 Total Flows : 3349 Total Bytes : 32372372 Total Packets : 71252 IPv6 Total Flows : 1017 Total Bytes : 2014163 Total Packets : 7263 Regards, Otto.
I for one am interested, I have been using awk and such which is slow. Best regards, Thorhallur On 6.12.2011, at 17:59, "Otto" <mworld at twbc.net> wrote:> Hi. I added some code to flowd-reader. Is any one interested in being able to do this ? (inspired by flow-tools flow-stat). I found it helpful for debugging etc. It would be great to know how other people use flowd to gather statistics etc. > > flowd-reader -s flowd-2011-12-07-030500 > > Flow Statistics > > IPv4 > Total Flows : 3349 > Total Bytes : 32372372 > Total Packets : 71252 > > IPv6 > Total Flows : 1017 > Total Bytes : 2014163 > Total Packets : 7263 > > Regards, > Otto. > > _______________________________________________ > netflow-tools mailing list > netflow-tools at mindrot.org > https://lists.mindrot.org/mailman/listinfo/netflow-tools
Hi Thorhallur. I tested the attached patches in FreeBSD on version flowd-0.9.1. I''m interested if that is of any help in speeding things up for you. cd flowd-0.9.1 Need to run configure first to build the make file, then patch it, build, install. patch -p0 <flowd-reader.c.stats.patch patch -p0 <Makefile.stats.patch I tested it with a filter like this: (the target ip address is 192.168.20.247 and I discard any local traffic) # testFilterOut.fil discard src !192.168.20.247/32 discard dst 192.168.0.0/19 > cat /usr/flows/eth0/2011/2011-12/2011-12-07/* | ./flowd-reader -s -f /usr/flows/eth0/filters/testFilterOut.fil - Flow Statistics IPv4 Total Flows : 262921 Total Bytes : 3819349208 Total Packets : 9070763 IPv6 Total Flows : 0 Total Bytes : 0 Total Packets : 0 Regards, Otto. On 7/12/2011 4:38 AM, ??rhallur Sverrisson wrote:> I for one am interested, I have been using awk and such which is slow. > > Best regards, > > Thorhallur > > On 6.12.2011, at 17:59, "Otto"<mworld at twbc.net> wrote: > >> Hi. I added some code to flowd-reader. Is any one interested in being able to do this ? (inspired by flow-tools flow-stat). I found it helpful for debugging etc. It would be great to know how other people use flowd to gather statistics etc. >> >> flowd-reader -s flowd-2011-12-07-030500 >> >> Flow Statistics >> >> IPv4 >> Total Flows : 3349 >> Total Bytes : 32372372 >> Total Packets : 71252 >> >> IPv6 >> Total Flows : 1017 >> Total Bytes : 2014163 >> Total Packets : 7263 >> >> Regards, >> Otto. >> >> _______________________________________________ >> netflow-tools mailing list >> netflow-tools at mindrot.org >> https://lists.mindrot.org/mailman/listinfo/netflow-tools-------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: flowd-reader.c.stats.patch URL: <http://lists.mindrot.org/pipermail/netflow-tools/attachments/20111207/080fdc9c/attachment.ksh> -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: Makefile.stats.patch URL: <http://lists.mindrot.org/pipermail/netflow-tools/attachments/20111207/080fdc9c/attachment-0001.ksh>
Hi Thorhallur. How many flows are you processing at a time ? On our Sydney routers we process any where from 200 million to 1 billion flows a day (still flow-tools and IPv4 only at the moment). Although I wrote a custom program for doing that as a single thread would be slow. I am experimenting with flowd as a replacement to support IPv6 some time next year. Regards, Otto. On 7/12/2011 4:38 AM, ??rhallur Sverrisson wrote:> I for one am interested, I have been using awk and such which is slow. > > Best regards, > > Thorhallur > > On 6.12.2011, at 17:59, "Otto"<mworld at twbc.net> wrote: > >> Hi. I added some code to flowd-reader. Is any one interested in being able to do this ? (inspired by flow-tools flow-stat). I found it helpful for debugging etc. It would be great to know how other people use flowd to gather statistics etc. >> >> flowd-reader -s flowd-2011-12-07-030500 >> >> Flow Statistics >> >> IPv4 >> Total Flows : 3349 >> Total Bytes : 32372372 >> Total Packets : 71252 >> >> IPv6 >> Total Flows : 1017 >> Total Bytes : 2014163 >> Total Packets : 7263 >> >> Regards, >> Otto. >> >> _______________________________________________ >> netflow-tools mailing list >> netflow-tools at mindrot.org >> https://lists.mindrot.org/mailman/listinfo/netflow-tools