Re: Open source Netflow analysis for monitoring AS-to-AS traffic

[Steven Bakker <steven.bakker () ams-ix net>]

Hi Peter,

Thanks for that link. I did read the spec, and while the definition itself is clear, the escape clause gives a lot of 
wiggle room:

"Hardware limitations may prevent an exact reporting of the underlying frame length, but an agent should attempt to be 
as accurate as possible."

I read that as, "the vendor will do whatever it pleases, and you should be grateful to receive a non-negative integer 
at all." I could be too cynical, though.

Anyway, this particular vendor does other funny things (such as sometimes stripping the q-tag headers from the sampled 
frame; throttling the frame sampling on the box, but not adjusting the sampling interval in the sFlow exports) that 
make it a true joy to work with this gear. ;-)

Cheers,

-- Steven