Hi Jeff,
How often you get this message?
Every time you see it, you miss a packet. The way to read
that line is: libpcap passed only the first 37 bytes of
the datagram to pmacct; L4 appears to start at the 38th
octet; and you might have specified src_port or dst_port
in your aggregation method.
By default pmacct snaplen for IPv4 packets is 68 bytes,
so imposing something explicit wouldn't help. It appears
the reason for such truncation is external - hence the
question at the beginning of this email.
Cheers,
Paolo
On Sun, Feb 28, 2010 at 11:56:50PM -0800, Jeff Welling wrote:
Hello again all!
Just recently I started seeing this line in my logs every couple of minutes;
Feb 28 23:34:57 gir pmacctd[12915]: INFO ( default/core ): short IPv4
packet read (37/38/frags). Snaplen issue ?
Gir being the name of my gateway machine.
Recent events include installation of an additional internet connection
(dual-homed), and configuring pmacctd to monitor the new interface with
basically the same setup as my other interface, and setting the
interface to not auto-negotiate its speed because that was causing problems.
Does this mean pmacct is missing information? Should the snaplen be
increased, I dont think Im doing classification and CONFIG-KEYS says the
defaults should be ok unless your using classification?
Cheers,
Jeff.
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
