Hi Paolo, I definitly need a lightweight solution so it is sflow, and i use 'host sflow' with ulog to provide flow samples ( http://blog.sflow.com/2010/12/ulog.html ). i suppose that pmacctd is more accurate because i understand and correct me that it uses a promiscuous mode. tests are runing on a local machine. thanks for replying so quickly.
2013/9/9 Paolo Lucente <[email protected]> > Hi Oussama, > > Can you elaborate on your target deployment for billing (ie. sFlow > or promiscuous mode)? Can you also elaborate on the setup for your > test? What tool is generating sFlow data being sent to sfacctd? If > you have control over the host 192.168.42.226: which of the two > counters looks the most accurate (354000 or 1096303)? > > Cheers, > Paolo > > On Sun, Sep 08, 2013 at 12:05:31PM +0000, oussama sarhraoui wrote: > > I'm actually testing pmacct tools for a potential integration into our > > system to perform billing operations . So it is important for us to get > the > > most accurate information from these tools. so i run sfacctd and pmacctd > on > > a local machine with host sflow configured with the ULOG facility to > > collect traffic samples with a sampling rate 1 in 100. > > i used to following configuration within sfacctd : > > > > daemonize: true > > plugins: memory[ins], memory[outs] > > interface: eth0 > > sfacctd_ip: 192.168.42.226 > > sfacctd_port: 6343 > > sfacctd_renormalize: true > > aggregate[ins]: dst_host > > aggregate_filter[ins]: src net 173.194.0.0/16 > > aggregate[outs]: src_host > > aggregate_filter[outs]: dst net 173.194.0.0/16 > > imt_path[ins]: /tmp/pmacct_ins.pipe > > imt_path[outs]: /tmp/pmacct_outs.pipe > > ! > > > > and the following for pmacctd : > > > > daemonize: true > > plugins: memory[in], memory[out] > > interface: eth0 > > aggregate[in]: dst_host > > aggregate_filter[in]: src net 173.194.0.0/16 > > aggregate[out]: src_host > > aggregate_filter[out]: dst net 173.194.0.0/16 > > imt_path[in]: /tmp/pmacct_in.pipe > > imt_path[out]: /tmp/pmacct_out.pipe > > ! > > > > the problem is that i found a big difference between these two tools : > > sfacctd shows : > > > > DST_IP PACKETS BYTES > > 192.168.42.226 1600 354000 > > > > and pmacctd shows : > > > > DST_IP PACKETS BYTES > > 192.168.42.226 1718 1096303 > > > > thanks for any remarque or suggestion and for help :) > > > > cheers. > > > > -- > > *SARHRAOUI Oussama * > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > -- *SARHRAOUI Oussama *
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
