Hi Paolo,
I have to collect aglow and nflow , after consideration I assign sflow to port
999 and nflow to port 997.
But in this thread I have a 2nd thought that I can assign both sflow and nflow
to a single port listen by libcap app. Is this a good approach ? Any risk ,like
packet drop?
I've seen a commercial solution that can collect all flow protocol in a single
port , but don't how this implemented.
Sent from my ASUS
-------- 原始郵件 --------
寄件者：Paolo Lucente
傳送日期：Thu, 25 Feb 2016 05:53:05 +0800
收件者：[email protected]
主旨:Re: [pmacct-discussion] Multiple pmacct processes listening at similar
interface
Hi Franz,
Yes, it's no problem if, in general, two processes running libpcap
are binding to the same interface. You can in fact not only have any
two pmacctd binding there, but also a pmacctd and a tcpdump, etc.
Cheers,
Paolo
On Tue, Feb 23, 2016 at 01:23:29PM +0100, fboehm wrote:
> Hi,
>
> I couldn't find a definitive answer on the web regarding following
> situation:
>
> Is it technically ok if multiple pmacct instances listen to the same
> interface via libpcap? The interface is in promiscuous mode and is
> getting traffic via a mirrored switch-port.
>
> I like it because I don't need to restart all plugins after I
> changed the configuration of just one plugin.
>
> Until now it seems to work but I'm not sure how to check if all
> pmacct instances are processing 100% of the incoming packets. Maybe
> such a setup works but isn't described anywhere because it's
> considered too cpu demanding in high-traffic environments.
>
> Thanks,
> Franz
>
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
====================================================================
本信件可能包含工研院機密資訊，非指定之收件者，請勿使用或揭露本信件內容，並請銷毀此信件。
This email may contain confidential information. Please do not use or disclose
it in any way and delete it if you are not the intended recipient.
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
