Tutorial >> Filters, Queues and Bandwidth | TOC |
Sampling filters allow you to probabilistically select a fraction of packets that match an auxilliary filter and are typically used for monitoring packet flows. You may want to skip this section for now and return to it after you have read about how to use router plugins . Although a sampling filter can be used without a plugin, it becomes much more useful in conjunction with a plugin that can process the sampled packets. The main things to remember are:
For example, suppose we use the one-NSP configuration shown to the right
and send traffic from n1p2 to n1p3.
We install an auxilliary filter (shown below) at egress port 3
that will sample at
the 25% level and send all selected packets to a stats plugin.
The filter shows that selected packets are sent to SPC queue 8 which
has a QID of 136.
The stats plugin
counts the number of ICMP, TCP, and UDP packets and then drops the packet.
It is summarized in
Predefined_Plugins and its use is described in
Monitoring With A Plugin.
The plugin table at port 3 is shown to the right. It is linked to the filter via the SPC QID of 8. That is, packets selected by the filter is sent to the SPC via SPC QID 8, and the plugin reads packets from SPC QID 8. To test the capabilities of the sampling filter, we send four consecutive flows through port 3:
The output shows that the number of ICMP (ping) packets seen by the
stats plugin for each of the first three flow are 9, 13, and 10.
Note that the count is not exactly 25% of the 32 packets sent, and the
count is different in each case.
In the case of the UDP flow, the plugin counted 122 packets.
Again, the count is not exactly 25% of the 500 packets sent; i.e., not 125.
Revised: Fri, Feb 15, 2008
Tutorial >> Filters, Queues and Bandwidth | TOC |