Hi Garrett,
I'm not aware of a problem with softflowd. The records btw are around 7s apart
- so it looks unlikely, that it is the
same same flow.
If you do not have nsel records you may use the std formats to display the
records e.g. -o line
If you can not get arount this, I need to check with pfsense.
Cheers
- Peter
On 20.11.15 17:39, Garrett Burke wrote:
> All,
>
> I'm using pfSense 2.2.4 with softflowd 1.2.1 exporting Netflow v5 packets to
> nfsen with nfdump: Version: NSEL-NEL1.6.11 and I'm seeing double counting of
> the bps.
>
> If I generate a 10Mbps flow through the pfSense firewall with iperf, it's
> being displayed as 20Mbps. The pfSense counters show it correctly as 10Mbps.
>
> It looks like softflowd is sending the records twice, as I see the following
> in the nfcapd files:
>
> # nfdump -r nfcapd.201511201555
> Date first seen Event XEvent Proto Src IP Addr:Port
> Dst IP Addr:Port X-Src IP Addr:Port X-Dst IP Addr:Port In Byte
> Out Byte
> 2015-11-20 15:50:22.588 IGNORE Ignore UDP 172.22.37.250:55138 ->
> 128.18.1.1:5001 0.0.0.0:0 -> 0.0.0.0:0 382.7 M
> 0
> 2015-11-20 15:50:29.099 IGNORE Ignore UDP 172.22.37.250:55138 ->
> 128.18.1.1:5001 0.0.0.0:0 -> 0.0.0.0:0 386.5 M
> 0
>
> Has anyone else seen this?
>
> Is there a way to get nfsen/nfdump to ignore the duplicates (if that is what
> they are)?
>
> Thks,
> GB
>
> --
> Garrett Burke
> VP Engineering
> Egenera Inc. | Converge. Unify. Simplify.�
> 00-353-1-9022868 (office)
>
> http://www.egenera.com
> http://blog.egenera.com
> http://www.facebook.com/#!/pages/Egenera/74312707811
> http://twitter.com/#!/Egenera
> http://www.linkedin.com/company/7909?trk=tyah
>
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Nfdump-discuss mailing list
> Nfdump-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
