Hi, I just wanted to share something that just cost me 2 days of head-scratching.
I found out that, if the system hosting sfacctd does not have a route to the sflow agent going out from the same interface the sflow packets arrive; sfacctd will not account the data *even if they show up on a tcpdump*. Let me explain My debian host has 2 interfaces : eth0 and eth1. 0 is used for management and internet access (thus having a default gateway) and 1 is just a link to my lab router with a /24 over it. What doesn't work : Sourcing sflow packets from my router's loopback address : the sflow packets show up on a tcpdump but nothing in pmacct's backend. What does work : - Sourcing the sflow packet from the interface directly connected in the /24. - Adding a route to the loopback address in the debian routing table pointing to the router I just tried every possible combination of aggregates, aggregate filters and plugins before coming to that. Just a curiosity : would this be a feature of pmacct, or something in the way linux handle udp datagrams ? Hope this help someone someday like this ( http://www.mail-archive.com/[email protected]/msg01470.html ) helped me once. :) Regards, Benjamin Abadie _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
