Hi Martin, On Mon, Jan 13, 2014 at 02:45:25PM +0100, Martin Topholm wrote:
> On Fri, 10 Jan 2014, Paolo Lucente wrote: > > [ .. ] > > > Any chance the traffic is VLAN-tagged and/or MPLS-labelled and > > VLAN tag and/or MPLS labels are exposed to pmacct via IPFIX? In > > such a case you should reflect this in the filter, ie. 'vlan > > and ...', 'mpls and ...' or 'vlan and mpls and ...'. > > This appears to be the case. If all rules are duplicated with > "vlan or (...)" everyting seems to work, only expected non-classified > traffic remains with tag 901 and 902. > > How come the vlan expression is needed? Great to know. libpcap is leveraged for filtering purposes ('filter' keyword in pre_tag_map and 'aggregate_filter') and this is a known limitation (perhaps the most annoying) of libpcap-based filters. It's some time i'm thinking would be good to find viable (ie. also more efficient) alternatives to that. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists