Hi Paul, i know it's a trivial question, but the only on top of my mind at the moment: are you sure there aren't any firewall rules setup on the box preventing this to work? Ie. the type of socket employed by tcpdump can see packets allright even if they are dropped before reaching the application, say, by iptables.
Cheers, Paolo On Thu, Jul 19, 2007 at 07:18:27PM +0100, paul cunnane wrote: > Hi all - I just built pmacct to collect traffic information from our > Cisco router. We've already been using a NetFlow VMware appliance to > graph the flows, so I know the router is sending out useful > information. > > We've reconfigured the router to send NetFlow packets to both the > appliance and to the new server I've built pmacct on. When I tcpdump, > I can see the NetFlow packets arriving on port 2055 as configured. > > If I run nfacctd, listening on port 2055, it says it's waiting for > data on UDP port 2055, but it doesn't seem to hear anything, whether I > run it with the "print" plugin, or using memory tables and querying > using pmacct -s: > > [EMAIL PROTECTED] pmacct-0.11.4]# nfacctd -l 2055 -P print -r 5 > WARN ( default/print ): defaulting to SRC HOST aggregation. > INFO ( default/core ): waiting for data on UDP port '2055' > ID CLASS SRC_MAC DST_MAC VLAN > SRC_AS DST_AS SRC_IP DST_IP SRC_PORT DST_PORT > TCP_FLAGS PROTOCOL TOS PACKETS FLOWS BYTES > > ...and nothing else appears. > > Am I missing something stupidly obvious? _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
