Hi Hendrik,
What direction are you sampling NetFlow traffic at your edges? Is it
consistent, are you sampling at both place in the same direction, either
ingress (which would make more sense) or egress (which would make slight
less sense)? If so, i'd be puzzled why you would get duplicated traffic;
if, instead, you mix directions or do both at both endpoints, etc. then,
yeah, that makes sense (and if so we can further analize the scenario).
Paolo
On 12/5/21 11:44, Hendrik Meyburgh wrote:
Hi.
I have an issue where my setup is causing double counting when using
sum_host using the below topology. The sampling is set up on the
interface where the SRC is located and also on the peering edges. My
config is below, is there something else which I can enable to stop this
from happening? We are currently testing setting the same
observation-domain-id for both routers to see if that will help.
Thank you.
+------------+ +-------------+
SRC --------- Router1 +<--------->+ Router2 +--------------- DST
Sampling +--------+---+ +--------+----+. Sampling
| |
| |
| |
| |
| |
| |
+--+-----------+--+
| |
| pmacct |
+-----------+
daemonize: true
nfacctd_port: 2100
logfile: /var/log/nfacctd.log
!debug: true
plugins: print[SUM]
! Test2: disable below
nfacctd_renormalize: true
!nfacctd_ext_sampling_rate: 1024
nfacctd_pro_rating: true
!
nfacctd_time_new: true
aggregate[SUM]: sum_host
networks_file[SUM]: /root/pmacct/TARGETS
networks_file_filter[SUM]: true
print_cache_entries[SUM]: 99991
print_refresh_time[SUM]: 300
print_history[SUM]: 5m
print_output[SUM]: csv
print_output_file[SUM]: /root/pmacct/SUM/file-%Y%m%d-%H%M.txt
print_history_roundoff[SUM]: m
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
