Hi Ryan, i've reproduced a very simple scenario:
spanned port =(libpcap)=> pmacctd =(NF v9)=> nfacctd. I then queried the memory plugin attached to the nfacctd daemon. I can verify MAC addresses are showing up correctly. Following is the configuration in place: === ! ! pmacctd config ! interface: eth4 plugins: nfprobe aggregate: src_mac,dst_mac,src_host,dst_host,src_port,dst_port,proto,tos nfprobe_receiver: 127.0.0.1:2101 nfprobe_timeouts: tcp=120:maxlife=3600 nfprobe_version: 9 nfprobe_engine: 1:0 === === ! ! nfacctd configuration example ! nfacctd_ip: 127.0.0.1 nfacctd_port: 2101 plugins: memory aggregate: src_mac,dst_mac,src_host,dst_host,src_port,dst_port,proto,tos === Is this any different from your config? If yes, can you please post it or expand? Are MAC addresses available to the pmacctd daemon (ie. was thinking, maybe you are reading a DLT_LINUX_SLL data link)? Let me know. Cheers, Paolo On Tue, Jun 24, 2008 at 08:00:00PM -0500, Ryan wrote: > I can't get nfprobe to include src_mac or dst_mac in the payload. I'm > collecting the info with nfacctd. I have nfacctd in debug mode, but I > just get '00:00:00:00:00:00' for the MAC address. > > my pmacct.conf: > aggregate: src_mac, dst_mac, dst_port, src_host, dst_host, proto > plugins: nfprobe > nfprobe_version: 9 > > I'm successfully inserting the packets just with no MAC. > > Thanks, > Ryan _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
