netflow sampling rate

RouterOS General
1

how to configure the sampling parameters to get 1/5000 netflow sampling rate?
it is very difficult to understand from you manual where:
sampling-interval (integer; Default: 0) The number of packets that are consecutively sampled.
sampling-space (integer; Default: 0) The number of packets that are consecutively omitted.
/ip/traffic-flow/set packet-sampling=yes sampling-interval=2222 sampling-space=1111
2222 packet consecutive packets will be sampled and then 1111 will be omitted. Then the sampling cycle repeats in such a manner.

regards
Ros

2

/ip/traffic-flow/set packet-sampling=yes sampling-interval=1 sampling-space=4999 ???

3

not working, getting the same amount of rawflow then when "no sampling"
thx

4

What is actually packet-sampling from mikrotik point of view? From their help page it is not clear at all.
I guess routeros collects flows for

packet sampling interval

and then send them to the target. But what is then ‘packet sampling space’ parameter?

5

I am also interested. Can somebody explain?

6

Same in ROS7.7 - I tried Interval 1, Space 4999 to try and get 1 in 5000, but it’s clearly wrong - even raw output to my collector with no sampling doesn’t seem to make much sense. I see traffic spikes reported that are bigger than the interfaces the traffic is traversing (25Gbps+ flows on 10Gbps ports etc)

There’s also a bug in the Mikrotik implementation here (https://github.com/akvorado/akvorado/issues/417 https://github.com/netsampler/goflow2/issues/113). It doesn’t help that the sampling rate isn’t advertised properly along with the data being sent, so at least the other side could know how to interpret.

I’m using Akvorado as my Netflow system.

7

I’m in the same situation, Akvorado discards the Mikrotik flows as invalid

8

Im seeing the exact same issue with Akvorado as well (when using a mikrotik ros v6.49.6 or v7.6 to send Netflow v5 to Akvorado :2055).

it gets marked as invalid flow, and dropped as a result (so no data shows up).
hoping this can get fixed in ros.