Network Traffic Analysis Statistics on eSight V200R003C10SPC200 Are Abnormal

Publication Date:  2015-11-03 Views:  327 Downloads:  0
Issue Description
Network traffic analysis is enabled and an interface is being monitored by eSight. However, eSight fails to obtain incoming or outgoing traffic statistics from the interface.

For example, eSight can collect incoming traffic statistics from the interface, but the outgoing traffic statistics of the interface is 0.
Handling Process
1. Check the configuration. The result shows that the NetStream function is enabled on only some interfaces.

Based on the networking, it is recommended that the NetStream function be enabled in both the inbound and outbound directions for uplink interfaces only, and disabled for downlink interfaces. Alternatively, the NetStream function can be enabled in only the inbound direction for both uplink and downlink interfaces.

2. After the NetStream configuration is correctly deployed, eSight still cannot collect traffic statistics in the outbound direction. Further analysis shows that the sampling ratio in the outbound direction on the device differs from that on eSight. Change the sampling ratio to be the same value, and the fault is resolved.

− Configuration on the uplink interface:

[HUAWEI-GigabitEthernet5/0/0] ip netstream sampler fix-packets 1000 inbound
[HUAWEI-GigabitEthernet5/0/0] ip netstream sampler fix-packets 1000 outbound

− Configuration on eSight
Root Cause
If you enable the NetStream function on a downlink interface, you also need to enable the function for the uplink interface in only the inbound direction. If you enable the NetStream function on an uplink interface in both directions, you need to disable the function for the downlink interface.

The sampling ratio in the outbound direction on the device differs from that on eSight.
Solution
To ensure that eSight can correctly collect both incoming and outgoing traffic statistics from an interface, enable the NetStream function correctly and set the sampling ratio on the device to be the same as that on eSight.

END