Hi TC, Consider nfacctd and sfacctd do not use libpcap in order to read the incoming NetFlow/IPFIX and sFlow packets respectively; only pmacctd uses libpcap. This is why you can't let both nfacctd and sfacctd bind to the same port and IP address.
Cheers, Paolo On Thu, Feb 25, 2016 at 12:58:25AM +0000, itria30...@itri.org.tw wrote: > Hi Paolo, > > I have to collect aglow and nflow , after consideration I assign sflow to > port 999 and nflow to port 997. > > But in this thread I have a 2nd thought that I can assign both sflow and > nflow to a single port listen by libcap app. Is this a good approach ? Any > risk ,like packet drop? > > I've seen a commercial solution that can collect all flow protocol in a > single port , but don't how this implemented. > > Sent from my ASUS > > -------- ???l?l?? -------- > ?H?????GPaolo Lucente > ???e?????GThu, 25 Feb 2016 05:53:05 +0800 > ???????gpmacct-discuss...@pmacct.net > ?D??:Re: [pmacct-discussion] Multiple pmacct processes listening at similar > interface > > Hi Franz, > > Yes, it's no problem if, in general, two processes running libpcap > are binding to the same interface. You can in fact not only have any > two pmacctd binding there, but also a pmacctd and a tcpdump, etc. > > Cheers, > Paolo > > On Tue, Feb 23, 2016 at 01:23:29PM +0100, fboehm wrote: > > Hi, > > > > I couldn't find a definitive answer on the web regarding following > > situation: > > > > Is it technically ok if multiple pmacct instances listen to the same > > interface via libpcap? The interface is in promiscuous mode and is > > getting traffic via a mirrored switch-port. > > > > I like it because I don't need to restart all plugins after I > > changed the configuration of just one plugin. > > > > Until now it seems to work but I'm not sure how to check if all > > pmacct instances are processing 100% of the incoming packets. Maybe > > such a setup works but isn't described anywhere because it's > > considered too cpu demanding in high-traffic environments. > > > > Thanks, > > Franz > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > > > ==================================================================== > ???H???i???]?t?u???|???K???T?A?D???w?????????A?????????????S???H?????e?A?????P?????H???C > > This email may contain confidential information. Please do not use or > disclose it in any way and delete it if you are not the intended recipient. _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
