Hi Edvinas,

You may want to check whether libpcap is dropping packets on input to
pmacctd. You can achieve that sending a SIGUSR1 and checking the output
in the logfile/syslog/console. You will get something a-la:

https://github.com/pmacct/pmacct/blob/master/docs/SIGNALS#L16-#L34

Should amount of dropped packets be non-zero and visibly increasing then
you may want to put your libpcap on steroids:

https://github.com/pmacct/pmacct/blob/master/FAQS#L71-#L101

Should, instead, that not be the case, i am unsure and would need
further investigation. You could try to produce a controlled stream of
data and sniff nfprobe output. Or collect with a different software for
a quick counter-test (nfacctd itself or another of your choice).

Paolo

On Fri, Dec 14, 2018 at 03:02:35PM +0200, Edvinas K wrote:
> Thanks, i really appreciate your help.
> 
> Everything seems working OK, on NFSEN (NFDUMP) graphs of flows statistics
> looks good, but the traffic rate Mb/s (45 Mb/s) is somehow 10x lower than
> really is. Maybe some tips to troubleshoot that ?
> 
> [image: image.png]
> 
> Is there any hidden things to check about ?
> 
> My config:
> 
> 1050  pmacctd -i ens1f0.432 -f flowexport.cfg
> 1051  pmacctd -i ens1f1.433 -f flowexport.cfg
> 
> cat flowexport.cfg
>    !
>    daemonize: true
>    aggregate: src_host, dst_host, src_port, dst_port, proto, tos
>    plugins: nfprobe
>    nfprobe_receiver: 10.3.14.101:2101
>    nfprobe_version: 9
>    ! nfprobe_engine: 1:1
>    ! nfprobe_timeouts: tcp=120:maxlife=3600
>    !
>    ! networks_file: /path/to/networks.lst
> 
> On Thu, Dec 13, 2018 at 4:32 AM Paolo Lucente <pa...@pmacct.net> wrote:
> 
> >
> > Hi Nikola,
> >
> > I see, makes sense. Thanks very much for clarifying.
> >
> > Paolo
> >
> > On Wed, Dec 12, 2018 at 06:20:58PM -0800, Nikola Kolev wrote:
> > > Hi Paollo,
> > >
> > > Sorry for being cryptic - what I meant was that I wasn't able to
> > > launch pmacctd/uacctd in a way that it deals with dynamic interfaces as
> > > ppp. Basically I failed to find any reference in the docs on how to make
> > > it run in such a way, that it collects info from ppp* (a-la the ppp+
> > > syntax of iptables), without launching a separate pmacctd instance for
> > > each interface, hence the complicated setup with
> > > iptables-nflog-uacctd-nfdump.
> > >
> > > On Thu, 13 Dec 2018 01:35:00 +0000
> > > Paolo Lucente <pa...@pmacct.net> wrote:
> > >
> > > >
> > > > Hi Nikola,
> > > >
> > > > Can you please elaborate a bit more? The cryptic part for me is "as
> > > > nfacctd is not supporting wildcard addresses to be bound to".
> > > >
> > > > Thanks,
> > > > Paolo
> > > >
> > > > On Wed, Dec 12, 2018 at 04:50:33PM -0800, Nikola Kolev wrote:
> > > > > Hey,
> > > > >
> > > > > If I may add to that:
> > > > >
> > > > > I'm doing something similar, but in a slightly different manner:
> > > > >
> > > > > as nfacctd is not supporting wildcard addresses to be bound to, I'm
> > > > > using iptables' rules to export via nflog to uacctd, which then can
> > > > > send to nfdump. Just food for thought...
> > > > >
> > > > > On 2018-12-12 14:58, Paolo Lucente wrote:
> > > > > >Hi Edvinas,
> > > > > >
> > > > > >You are looking for the nfprobe plugin. You can follow the relevant
> > > > > >section in the QUICKSTART to get going:
> > > > > >
> > > > > >https://github.com/pmacct/pmacct/blob/1.7.2/QUICKSTART#L1167-#L1302
> > > > > >
> > > > > >Paolo
> > > > > >
> > > > > >On Wed, Dec 12, 2018 at 03:12:39PM +0200, Edvinas K wrote:
> > > > > >>Hello,
> > > > > >>
> > > > > >>I managed to run basic pmacct to capture linux router (FRR) flows
> > > > > >>from libcap:
> > > > > >>"pmacctd -P print -O formatted -r 10 -i bond0.2170 -c
> > > > > >>src_host,dst_host,src_port,dst_port,proto"
> > > > > >>
> > > > > >>now I need to push all the flows as a netflow format to the
> > > > > >>netflow collector (nfdump). Could you give me some advice how to
> > > > > >>configure that ?
> > > > > >>Thank you
> > > > > >
> > > > > >>_______________________________________________
> > > > > >>pmacct-discussion mailing list
> > > > > >>http://www.pmacct.net/#mailinglists
> > > > > >
> > > > > >
> > > > > >_______________________________________________
> > > > > >pmacct-discussion mailing list
> > > > > >http://www.pmacct.net/#mailinglists
> > > > >
> > > > > --
> > > > > Nikola
> > >
> > >
> > > --
> > > Nikola
> >
> > _______________________________________________
> > pmacct-discussion mailing list
> > http://www.pmacct.net/#mailinglists
> >



_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to