Hi Andrei,
can you establish any criteria for that doubled traffic, ie. what gets
doubled and what is counted once, inbound vs. outbound, etc.? Moreover,
can you have a look what happens at layer2, any change in src/dst MAC
addresses? That would help but because you told that's bridged traffic
...
Hi Andrei,
the most immediate suggestion i can give you is to tap either tcpdump
or ethereal on the eth0 and see which traffic the libpcap library is
effectively returning; also, try playing with the 'promisc' directive
(which defaults to true) - as my understanding is that you are sniffing
I've set promisc to false (I just need local traffic passing through
eth0) but traffic still gets accounted twice.
Below is my conf:
===
debug: false
interface: eth0
daemonize: true
promisc: false
sql_db: bwstat
sql_table: acct
sql_table_version: 1
sql_passwd: ***
sql_user: ***
