Hi Matthias, One clarification: "Direct or via tee is not working, as ntop does not understand the flows.": you mean that even if you point the device exporting IPFIX directly to ntop - instead of pointing it to or via nfacctd - it does not read flows correctly?
Also, the configuration you mention makes use of the nfprobe plugin instead of the tee one; and exports to a port which is not the one on which the nfacctd receiver is listening - so it's not conveying much to me. You should use a pmacctd instance with two tee plugins, one exporting to a (local) nfacctd instance for parsing, the other to the 3rd party collector. Cheers, Paolo On Wed, Dec 19, 2012 at 10:54:24AM +0100, Matthias Brumm wrote: > Hi! > > I have an IPFIX flow source, which is successfully sending flows to a > nfacctd instance (pmacct -s works without problems). I am now trying to > relay this to a ntop process as a collector. Direct or via tee is not > working, as ntop does not understand the flows. > > I have found section X. in the examples, which seems to be an example, of > what I need. Unfortunatly the pmacctd instance seems to send only the flows > sniffed off the network-card and does not take the flows out of the memory. > It seems, that I am lacking a connection there. > > I am working with two very minimalistic configuration files: > > root@jadzia-lts:~# cat pmacctd.conf > daemonize:false > interface: eth0 > aggregate: src_host, dst_host, src_port, dst_port, proto, tos > plugins: nfprobe > nfprobe_receiver: 127.0.0.1:9990 > nfprobe_version: 9 > > root@jadzia-lts:~# cat nfpacct.conf > plugins:memory[display] > aggregate[display]: src_host, dst_host, src_port, dst_port, proto > daemonize:true > nfacctd_port:9999 > > Regards, > > Matthias > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
