Re: [pmacct-discussion] Traffic count only for certain networks

[Slava Dubrovskiy]

24.09.2009 01:06, Paolo Lucente пишет:
>> And it put tag 1 and 0 in the same ip_src and ip_dst
>>
>> mysql> select agent_id,ip_src,ip_dst,bytes from acct_v2 where ip_src
>> like '91.206.226.104' and ip_dst like '91.209.165.1';
>> +----------+----------------+--------------+--------+
>> | agent_id | ip_src         | ip_dst       | bytes  |
>> +----------+----------------+--------------+--------+
>> |        0 | 91.206.226.104 | 91.209.165.1 | 156040 |
>> |        1 | 91.206.226.104 | 91.209.165.1 |  19040 |
>> +----------+----------------+--------------+--------+
>> 2 rows in set (0.01 sec)
>>
>> Can you explain it?
>>     
> A couple things come to my mind:
> * A different router other than 192.168.21.1 which is exporting
>   NetFlow data to the collector.
>   
Yes! I forgot about another router.
> * Using NetFlow v9? If yes, any chance VLAN tags, MPLS labels or
>   both are exported as part of the NetFlow record? In such a case
>   you would need to refine the filter, ie. 'vlan and ...', 'mpls
>   and ...' or 'vlan and mpls and ...'.
>   
Yes. We use NetFlow v9 from Junuper m7i and NetFlow v5 from ipcad.
And we use vlan, but it's not necessary count it.
What do you mean about "need to refine the filter" ?

> * Stale data? The query above doesn't show stamp_inserted and/or
>   stamp_updated fields. They might give a clue aswell.
>   
No. I checked it.
> * pre_tag_map containing more than 50000 entries? Dumb question
>   but always better to ask and double check.
>   
wc -l /etc/pmacct/pretag.map
6774 /etc/pmacct/pretag.map

50000 - It's with a store :)


Thanks for answers

-- 
WBR,
Dubrovskiy Vyacheslav

smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists