tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Improving the data supplied by BPF



"Arnaud Lacombe" <lacombar%gmail.com@localhost> writes:

>>>what if the count goes from 3 to... 3, ie. the seq number overflowed
>>>(for whatever reason) ?
>>
>> Highly unlinkely.
>>
> 2^32 1500-bytes packets is about 6TB of data, on 100Mbit link, the
> sequence number will wrap after 5.6 days (if you consider
> uni-directional traffic), on a 1Gb link, half a day and a bit more
> than 1 hour on a 10Gb link. This is the worst case scenario. Two
> records taken at the <wrap_time> interval will likely collide on
> high-load link.

Will they?  Wouldn't you have to not sample for a whole <wrap period>
for it not to be immediately obvious that a wraparound had occurred?

Is an application which wants to fill a 100MB link, but not sample more
than once every five days what we should be designing for?

-- 
                                Jim Wise
                                jwise%draga.com@localhost

Attachment: pgpNxTxcYg1F4.pgp
Description: PGP signature



Home | Main Index | Thread Index | Old Index