我想通过编写一个接收 sFlow 数据报、解析它们、仅提取关键信息并应用一个公式来总结特定 IP 源的流量(以字节为单位)的 sFlow 收集器来近似以字节为单位的网络流量。我感兴趣的是公式和我必须提取的关键信息。
如何从 sFlow 数据报计算流量(以字节为单位)?
网络工程
UDP
监控
流量
2022-02-21 18:51:38
2个回答
frame_length 字段在 sFlow 版本 5 规范的第 35 页上定义,https://sflow.org/sflow_version_5.txt
unsigned int frame_length; /* Original length of packet before
sampling.
Note: For a layer 2 header_protocol,
length is total number of octets
of data received on the network
(excluding framing bits but
including FCS octets).
Hardware limitations may
prevent an exact reporting
of the underlying frame length,
but an agent should attempt to
be as accurate as possible. Any
octets added to the frame_length
to compensate for encapsulations
removed by the underlying hardware
must also be added to the stripped
count. */
该字段由 sflowtool 打印为 sampledPacketSize,https://github.com/sflow/sflowtool
采样率字段在上述文档的第 29 页上定义。此外,开关上还配置了采样率。
unsigned int sampling_rate; /* sFlowPacketSamplingRate */
为 sFlow 数据源计算字节的一种简单方法是将 frame_length 值相加并乘以采样率。
sFlow 收集以 1/ n分数指定的样本。轮询以秒为单位指定。
基本上,您只需将样本乘以n并除以s即可获得估计的数据包/秒。
其它你可能感兴趣的问题