Hi Jim, On Monday 04 February 2008, Jim Archer wrote: > Do I have this right? If so, here are my questions. > > if the interface held in promiscuous mode, or switched in and out of it for > sampling? > > Approximately how often does pmacct sample? > > How long is a typical sample?
I have no experience with the *flow features of pmacct, so the details on that might differ. We (the company I work for) currently use pmacct to do per-ip / per-customer billing including 95 percentile calculations. What we do is that we have pmacctd monitor the outside of our firewall contineously (which is the default for non-*flow setups, again: not sure if *flow setups are any diferent). During this monitoring it looks at all packets that pass by. Then it stores those by ip address in an in-memory table. This table is read and flushed every 5 minutes by a perl script written by myself. This perl script puts the data in to mysql-based backend. This way we have 5 minute interval data for each ip address we have in use. And allows us to calculations for total bandwidth, 95 percentile, etc. > How much performance impact is there? The performance of pmacct by default is pretty decent. We currently have it it running on firewalls with ~3GHz CPUs and gigabit network interfaces. We have peaked at 180Mbps of traffic during which the cpu load went up to about 30% (the firewalls also have about 3k of iptables rules active). The performance can be increased in a few ways: libpcap-mmap instead of the 'standard' libpcap or the use of PF_RING. The latter requires a kernel rebuild though. The bottomline is that any recent hardware (P4 based system) should be able to handle 100Mbps links without too much trouble. HTH. Regards, -- Ruben Laban Systems and Network Administrator [EMAIL PROTECTED] ISM eCompany Van Nelleweg 1 Postbus 13043 3004 HA Rotterdam +31 (0)10 243 6000 (tel) +31 (0)10 243 6066 (fax) www.ism.nl Quality Solutions - Reliable Partner _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
