Hi Jeff, How often you get this message?
Every time you see it, you miss a packet. The way to read that line is: libpcap passed only the first 37 bytes of the datagram to pmacct; L4 appears to start at the 38th octet; and you might have specified src_port or dst_port in your aggregation method. By default pmacct snaplen for IPv4 packets is 68 bytes, so imposing something explicit wouldn't help. It appears the reason for such truncation is external - hence the question at the beginning of this email. Cheers, Paolo On Sun, Feb 28, 2010 at 11:56:50PM -0800, Jeff Welling wrote: > Hello again all! > > Just recently I started seeing this line in my logs every couple of minutes; > > Feb 28 23:34:57 gir pmacctd[12915]: INFO ( default/core ): short IPv4 > packet read (37/38/frags). Snaplen issue ? > > Gir being the name of my gateway machine. > Recent events include installation of an additional internet connection > (dual-homed), and configuring pmacctd to monitor the new interface with > basically the same setup as my other interface, and setting the > interface to not auto-negotiate its speed because that was causing problems. > > Does this mean pmacct is missing information? Should the snaplen be > increased, I dont think Im doing classification and CONFIG-KEYS says the > defaults should be ok unless your using classification? > > Cheers, > Jeff. > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
