[ixpmanager] Discrepancies between sflow hosts

[Nick Hilliard]

Hi Ian,

Ian Chilton wrote on 18/02/2021 22:37:
> This evening I was hoping to switch over. I added a 2nd sflow 
> destination to all of our switches.

I'd recommend (strongly) against doing this.  All switch sflow 
implementations have sampler rate limiters, so you risk hitting those 
rate limiters if you configure multiple destinations, and you never know 
how those rate limiters will impact the sampler feed.  You're better off 
to use the fanout functionality from sflowtool - which is what you've 
done, so good on that one.

> I have a test IXP Manager instance pointing to the new sflow host and 
> our current instance pointing to the old host.
> 
> However, on the P2P graphs, the values coming from the new host are much 
> lower than the old host - up to 50%. This is reflected in both the Cur 
> values and the graphs themselves.

Hard to tell what's going on here.  A good starting point would be to 
compare the mrtg Infrastructure Aggregate Graphs against the sflow VLAN 
Graphs.  E.g. in INEX's case:

https://www.inex.ie/ixp/statistics/infrastructure/2/bits

should roughly equal the sum of the following two graphs:

https://www.inex.ie/ixp/statistics/vlan/3/ipv4/bits
https://www.inex.ie/ixp/statistics/vlan/3/ipv6/bits

Note that different switch platforms implement counters in different 
ways, and in addition, sflow and mrtg are counting fundamentally 
different things;  one handles bytes sampled over a 5m polling period, 
and the other creates graphs by looking at random packet samples, scaled 
by the packet sampling ratio.  This means that that the outcome is going 
to be different.  Typically sflow is between 3% and 7% lower than MRTG, 
depending on various things.

Are you running update-l2database.pl for your new installation?

Nick