check for this sysctl net.ipv4.conf.default.rp_filter = 0 (prob 1 in your case - it's a builtin RPF filter in linux; so your packets was dropped coz they failed rpf check)
17.07.2013, 16:04, "Benjamin Abadie" <[email protected]>: > Hi, > I just wanted to share something that just cost me 2 days of > head-scratching. > > I found out that, if the system hosting sfacctd does not have a route to > the sflow agent going out from the same interface the sflow packets > arrive; sfacctd will not account the data *even if they show up on a > tcpdump*. > > Let me explain > > My debian host has 2 interfaces : eth0 and eth1. 0 is used for > management and internet access (thus having a default gateway) and 1 is > just a link to my lab router with a /24 over it. > > What doesn't work : > Sourcing sflow packets from my router's loopback address : the sflow > packets show up on a tcpdump but nothing in pmacct's backend. > > What does work : > - Sourcing the sflow packet from the interface directly connected in the > /24. > - Adding a route to the loopback address in the debian routing table > pointing to the router > > I just tried every possible combination of aggregates, aggregate filters > and plugins before coming to that. > > Just a curiosity : would this be a feature of pmacct, or something in > the way linux handle udp datagrams ? > > Hope this help someone someday like this ( > http://www.mail-archive.com/[email protected]/msg01470.html ) > helped me once. :) > > Regards, > Benjamin Abadie > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists --- WBR, Nikita V Shirokov. NOC engineer www.yandex.ru _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
