I am exporting Netflow from 2 Mikrotik CCR (v9 but I also tried version 5) and 
trying to capture them with nfacctd. 
My config for testing:
plugins: print
!debug: true
print_refresh_time: 300
print_output: json
print_output_file: /tmp/nfacctd
nfacctd_port: 2056
nfacctd_renormalize: true
nfacctd_disable_checks: true
plugin_pipe_size: 102400000
plugin_buffer_size: 10240
aggregate: dst_host

The data nfacctd provided looked wrong and therefore i captured the exact same 
netflows (on 2 different ports) with nfacctd and nfcapd which shows these 
nfacctd (nfacctd 1.6.2-git) for test address: "packets": 698015, "bytes": 
nfcapd (Version: 1.6.12) for test address: packets: 879505 bytes: 704001361

nfcapd commandline: nfcapd -p 2055 -l /tmp -t 300

I am not sure why there is such a big difference, maybe someone can point me 
the right direction?

Kind Regards,

pmacct-discussion mailing list

Reply via email to