On 03/14/2009 12:38:09 PM, Chris Wilson wrote: > Hi Karl, > > On Sat, 14 Mar 2009, Karl O. Pinc wrote:
> > > As a debugging aid (or in general) you might consider putting your > > rfc1918 network in a networks file. With an aggregate on sum_net and > > > without any other filters you get the cross product of all the > > possibilities so can see if there's traffic from/to the local > network or > > other things you're perhaps not expecting. If nothing else a quick > test > > with the memory plugin may be revealing. > > Sorry, what is an aggregate on sum_net? I'm aggregating on ip_src and > ip_dst respectively in two different plugins. > > I have been thinking about using a networks file, although I'm not > sure > how to do it yet. sum_net gets you a all the traffic to and from each network you list in your networks file, plus to and from anywhere else. The cross product. In your case, if you put only 192.168.0.0/24 in your networks file you get out totals for the following possibilities. from to 192.168.0.0/24 0.0.0.0/0 0.0.0.0/0 192.168.0.0/24 192.168.0.0/24 192.168.0.0/24 0.0.0.0/0 0.0.0.0/0 You are interested in the first 3 (perhaps) and hope you don't get any of the last (perhaps). Karl <[email protected]> Free Software: "You don't pay back, you pay forward." -- Robert A. Heinlein _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
