Hello.
I'm running Debian with vanila 2.6.32 kernel.
I've compiled pmacct 0.11.6 with pf_ring (transparent mode 1).
Packets pass through brigde of 2 interfaces, one interface in promisc
mode (both interfaces are intel 82576, NAPI, LRO, RSS).
Load on this brigde is 800mbps and 100 kpps (90% idle on each of 8 cores).
I'm using pmacct to count traffic through brigde.
I've noticed, that snmp data and pmacct's data are the same (99% similar
in MB).
But if I use tcpflags in aggregation (src_host, dst_host, dst_port,
proto, tcpflags), I see (compare pmacct's data on bridge with tcpdump on
packet's destination host) that only 5% of packets with flag 2 (SYN) are
counted.
What could be the problem?
--
WBR
Yavetskiy Yuriy
ULTI-RIPE
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
