[pmacct-discussion] pmacct count only 5% of SYN packets.

[Yavetskiy Yuriy]

Hello.

I'm running Debian with vanila 2.6.32 kernel.
I've compiled pmacct 0.11.6 with pf_ring (transparent mode 1).
Packets pass through brigde of 2 interfaces, one interface in promisc 
mode (both interfaces are intel 82576, NAPI, LRO, RSS).
Load on this brigde is 800mbps and 100 kpps (90% idle on each of 8 cores).
I'm using pmacct to count traffic through brigde.
I've noticed, that snmp data and pmacct's data are the same (99% similar 
in MB).
But if I use tcpflags in aggregation (src_host, dst_host, dst_port, 
proto, tcpflags), I see (compare pmacct's data on bridge with tcpdump on 
packet's destination host) that only 5% of packets with flag 2 (SYN) are 
counted.
What could be the problem?


--
WBR
Yavetskiy Yuriy
ULTI-RIPE


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists