Hello David, On Wed, Jan 04, 2006 at 10:01:31AM -0500, David Filion wrote:
> The problem I have now is the mac_src, mac_dst, src_port and dst_port > fields are always 0 (protocol is ip). I've added a ports file that currently Here the solution is quite simple: your configuration has an 'aggregate: src_host' line. To do the job, you should change it to 'aggregate: src_mac, dst_mac, dst_port'. Available primitives for the key are listed into the CONFIG-KEYS document. The 'ports_file' is meant to be a filter: imagine you wish just to account the traffic to a few ports (not all), you list such ports in that file. All the traffic directed to the ports you are NOT interested in, will be summed in an entry containing as port value '0'. Cheers, Paolo
