fangzz\(方正泽\ | 8 Jul 13:12 2005
Picon

summary of octets percent exceed 100%


  hello,

  I meet a problem when i use flow-stat and flow-report. The summary of octets percent exceed 100%. The command is:

  flow-cat ft-v05.2005-07-08.180000+0800 | flow-stat -f11 -P -S2 | head -500

  I use flow-stat with -P option to get octet percent of ipaddr, and the result is:

# IPaddr         flows    octets   packets
#
202.107.217.***  0.085    3.478    2.222
202.107.217.***  0.084    2.786    1.867
202.107.217.***  0.065    2.690    2.002
202.107.217.***  0.085    2.641    1.749
202.107.217.***  0.085    2.597    1.696
..............

  Then I sum second field of total 500 record manually, the sumval = 127.27. I think this value must less than 100. When I stat UDP/TCP port(-f7), this problem appear again.

  I do the experiment in flow-report, I get the same result.

#  --- ---- ---- Report Information --- --- ---
# build-version:        flow-tools 0.67
# name:                 IPAddr
# type:                 ip-address
# scale:                1
# options:              +percent-total,+header,+xheader,+totals
# ip-src-addr-type:     address
# ip-dst-addr-type:     address
# sort_field:           +octets
# fields:               +key,+flows,+octets,+packets,+other
# records:              32
# first-flow:           731113371 Wed Mar  3 07:02:51 1993
# last-flow:            731113947 Wed Mar  3 07:12:27 1993
# now:                  1120820136 Fri Jul  8 18:55:36 2005
#
# mode:                 streaming
# compress:             off
# byte order:           big
# stream version:       3
# export version:       5
#
# rec1: ignores,flows,octets,packets,duration
0,1157,118572,1376,318376
# recn: ip-address*,flows,octets,packets
192.168.0.155,91.097666,66.401849,76.744186
192.168.0.219,90.924806,66.071248,76.453488
192.168.0.255,8.729473,33.422730,23.110465
192.168.0.47,1.382887,13.254394,8.720930

  octets percent of 192.168.0.155 is 66.4%, and octets percent of 192.168.0.219 is 66.07%. the sum of these records is much larger than 100%.

  The config file is:

stat-report IPAddr
   type ip-address
   scale 1
   ip-source-address-format address
   ip-destination-address-format address
   output
         format ascii
         sort +octets
         fields +octets,+flows,+packets,-duration
         options +header,+xheader,+totals,+percent-total
         path /emv/netflow/tmp/IPAddr.1120813926988

   stat-definition stat_def
          report IPAddr

   How to explain this problem?

   thanks!


Javis Fang
ZOOM Networks
Nanjing Telecom. Software
Tel: 025-84820080 ext. 287
Fax: 025-84826660
E-mail:fangzz-HLjTp8qDGDUIhP1ydL5T/A@public.gmane.org

_______________________________________________
Flow-tools mailing list
flow-tools@...
http://mailman.splintered.net/mailman/listinfo/flow-tools

Gmane