Hi Paolo,

Sorry for sending previous email directly to you - pmacct version is 1.62

We had been using fprobe to capture netflow data. The packets fprobe emitted
usually were 1464 bytes.

When we switched to using pmacct with the config below most of the packets are 
less
than 500 bytes. Is there something we can configure to make the packets larger 
so
there is less inefficiencies in transmission.



debug: false
pidfile: /var/run/pmacctd.pid
syslog: daemon
daemonize: true
interface: eth0
aggregate: src_host, dst_host, src_port, dst_port, proto, tos
plugins: nfprobe[eth0]
!aggregate_filter[eth0]: not host $IP
!plugin_buffer_size: 10240
!plugin_pipe_size: 819200000
nfprobe_receiver: 67.109.163.27:2055
nfprobe_version: 9
nfprobe_direction[eth0]: in
nfprobe_ifindex[eth0]: 2
!pre_tag_map: /etc/pmacct_netwolves/pretag.map
!nfprobe_timeouts:
expint=5:general=60:tcp=60:tcp.rst=60:tcp.fin=60:udp=60:maxlife=60
!
! networks_file: /path/to/networks.lst
! classifiers: /path/to/classifiers/
! snaplen: 1500


*tcpdump of packets emitted by fprobe:**
*
08:39:24.052173 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:24.062333 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.009242 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.009335 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.009442 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.009525 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.009592 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.009680 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.019814 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464
08:39:29.019907 IP 192.169.1.5.54417 > xxx.xxx.xxx.xxx.2055: UDP, length 1464


*tcpdump of packets from pmacct:*

08:43:22.032873 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 368
08:43:22.046400 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.050473 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.055756 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.059596 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.063091 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.074011 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 252
08:43:22.079973 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 480
08:43:22.080027 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 480
08:43:22.080079 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 480
08:43:22.080122 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 424
08:43:22.080236 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 424
08:43:22.080340 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 292
08:43:22.084008 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 480
08:43:22.084070 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.103153 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.106394 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.109548 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.112884 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.118893 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.122268 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.125993 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 252
08:43:22.129375 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 252
08:43:22.133180 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 368
08:43:22.137965 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.144987 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 140
08:43:22.154058 IP 192.169.1.5.52087 > xxx.xxx.xxx.xxx.2055: UDP, length 252


Regards,
Steve

-- 

"They that give up essential liberty to obtain temporary safety, 
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty 
decreases."  (Thomas Jefferson)

"Beer is proof God loves us and wants us to be happy!" (Ben Franklin)

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to