From owner-freebsd-net@FreeBSD.ORG  Tue Oct 10 23:03:00 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9090616A47C
	for <freebsd-net@freebsd.org>; Tue, 10 Oct 2006 23:03:00 +0000 (UTC)
	(envelope-from mav@mavhome.dp.ua)
Received: from cmail.optima.ua (cmail.optima.ua [195.248.191.121])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 00E0D43D9E
	for <freebsd-net@freebsd.org>; Tue, 10 Oct 2006 23:02:45 +0000 (GMT)
	(envelope-from mav@mavhome.dp.ua)
X-Spam-Level: 64 [XX]
 (100%)	BAYESIAN TRAINING: 100
Received: from [195.248.178.122] (account mav@alkar.net HELO [192.168.3.5])
	by cmail.optima.ua (CommuniGate Pro SMTP 5.0.11)
	with ESMTPA id 17167624; Wed, 11 Oct 2006 02:02:44 +0300
Message-ID: <452C268E.4020700@mavhome.dp.ua>
Date: Wed, 11 Oct 2006 02:02:38 +0300
From: Alexander Motin <mav@mavhome.dp.ua>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.7.13) Gecko/20060414
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Ivan Alexandrovich <ivsan@ngs.ru>
References: <1160493809.00616691.1160482801@10.7.7.3>
In-Reply-To: <1160493809.00616691.1160482801@10.7.7.3>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-net@freebsd.org
Subject: Re: ng_netflow and router performance question
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Oct 2006 23:03:00 -0000

Hi.

I think, that there is not very good hash function now used in 
ng_netflow in traffic aggregation. So if
 > ip-addr varies from 10.60.0.0 to 10.60.100.255
means than destination address will vary in this range and all other 
parameters is remain constant then it will be worst case possible.

Try other traffic pattern (as example random ports or src addrs) or wait 
for some time. We have discussed it with author and hi will probably 
change this function.

-- 
Alexander Motin