My coworker, an IT guy in operation team, once proposed to set all router, including sflow and nflow equipments, to a single port on a single collector.
In the end we setup sfacctd listen on a port and nfacctd on the other. But I am wondering if it's possible to fulfill previous requirement? This feature is useful for ease (a little bit) of router setting. ________________________________________ 從: pmacct-discussion <pmacct-discussion-boun...@pmacct.net> 代表 fboehm <fbo...@aon.at> 寄件日期: 2016年02月27日 22:29 至: pmacct-discussion@pmacct.net 主旨: Re: [pmacct-discussion] Multiple pmacct processes listening at similar interface Am 27.02.2016 um 13:06 schrieb itria30...@itri.org.tw: > Is there potential risk, such as packet lost to implement a daemon (or > modify pmacct) listen to both Netflow and sflow and split them? Libcap > is known of packet drop when CPU low (I might be wrong for that > community keep improving). I think there is some misunderstanding. Only pmacctd process is using libpcap to capture packets and extract traffic information from this packets. The others (nfacctd and sfacctd) only open network ports and listen for incoming packets. They don't use libpcap. The traffic information for netflow or sflow is provided by a different system. Typically a router or switch. Also called a Netflow Exporter or sometimes Sensor. That means no raw packets are processed by nfacctd or sfacctd. Franz _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
