2

I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks

  • Between your two questions, it seems you want to drive a nail with a screwdriver. IPFIX is the wrong tool for the job. I can't even really understand why you would want to know the variance in packet sizes in a flow; it just doesn't seem like useful information. – Ron Maupin Feb 7 '17 at 14:29
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 6 '17 at 20:45
1

IPFIX's purpose is to measure packet flow, not the size of the single packet.

However, you can calculate the variance of packet size by time calculating the average size of a packet as the total flow volume divided by the number of packets during different intervals, and seeing how this value changes over time.

If you want to calculate the variance in size of different individual packets in a single flow, that's not possible AFAIK.

  • It can be a solution to add an entity to the IPFIX protocol? – 232376544333 Feb 7 '17 at 13:25
1

RMON can show the number of frames by size class, e.g. for HP Provision switches show rmon statistics <portno>:

Status and Counters - Port Counters for port 24

  Drop events     : 0                 Jabbers             : 0
  Octets          : 227,397,427       Collisions          : 0
  Packets         : 3,714,994,853     64 oct pkts         : 210,643,368
  Broadcast pkts  : 24,326,013        65-127 oct pkts     : 1,722,528,356

  Multicast pkts  : 83,481,276        128-255 oct pkts    : 719,535,071
  CRC errors      : 0                 256-511 oct pkts    : 243,979,239
  Runts           : 0                 512-1023 oct pkts   : 172,346,388
  Giants          : 0                 1024-1518 oct pkts  : 2,666,523,301
  Fragments       : 0
1

Understanding the characteristics of your data can be critical. If you can't get what you need with IPFIX, and it's somewhere you can get pcap files from, tcpdump-type tools plus awk-type tools will give you an answer pretty easily.

Use tcpdump or similar to get the packets you're interested in:

13:49:41.046756 IP 192.168.1.1.58465 > 192.168.1.88.17050: UDP, length 986
13:49:46.047115 ARP, Request who-has 192.168.1.88 tell 192.168.1.1, length 46
13:49:46.047165 ARP, Reply 192.168.1.88 is-at 30:65:ec:7f:3f:93, length 28
13:49:51.055195 IP 192.168.1.1.57133 > 192.168.1.88.17050: UDP, length 986
13:50:06.048098 IP 192.168.1.1.51649 > 192.168.1.88.17050: UDP, length 986

Then pipe through awk to get your statistics:

$ cat TCPDUMPOUTPUT \
| awk '{++n; l=$NF; x+=l; xx+=l*l;}\
END{m=x/n; printf("n=%d m=%.2f sd=%.2f\n", n, m, sqrt((xx/n)-(m*m)))}'
n=5 m=606.40 sd=464.95

If you care about the statistical niceties (stability, pop vs sample etc) use R or python instead. Certainly R will give you nice graphs to understand the distribution of whatever categorisations you're interested in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.