Hi Michael,

I would suggest to comment out buffering, especially if the volume of
NetFlow packets is not sustained (plugin_pipe_size, plugin_buffer_size);
that should return a more accurate comparison. Should differences still
persist, the course of action would be a unicast email to me with the
following info: 1) values reported by nfcapd; 2) a capture in libpcap
format of the NetFlow exported by your routers (so to reproduce things
in lab); 3) a sample of the output returned by nfacctd. 

Paolo

On Sat, Jun 17, 2017 at 08:06:29PM +0200, Michael wrote:
> Hi,
> 
> I am exporting Netflow from 2 Mikrotik CCR (v9 but I also tried version 5) 
> and trying to capture them with nfacctd. 
> My config for testing:
> plugins: print
> !debug: true
> print_refresh_time: 300
> print_output: json
> print_output_file: /tmp/nfacctd
> nfacctd_port: 2056
> nfacctd_renormalize: true
> nfacctd_disable_checks: true
> plugin_pipe_size: 102400000
> plugin_buffer_size: 10240
> aggregate: dst_host
> 
> 
> The data nfacctd provided looked wrong and therefore i captured the exact 
> same netflows (on 2 different ports) with nfacctd and nfcapd which shows 
> these results:
> nfacctd (nfacctd 1.6.2-git) for test address: "packets": 698015, "bytes": 
> 561208397
> nfcapd (Version: 1.6.12) for test address: packets: 879505 bytes: 704001361
> 
> nfcapd commandline: nfcapd -p 2055 -l /tmp -t 300
> 
> I am not sure why there is such a big difference, maybe someone can point me 
> the right direction?
> 
> Kind Regards,
> Michael
> 
> 
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to