[pmacct-discussion] pmacct count only 5% of SYN packets.

2010-02-09 Thread Yavetskiy Yuriy
Hello. I'm running Debian with vanila 2.6.32 kernel. I've compiled pmacct 0.11.6 with pf_ring (transparent mode 1). Packets pass through brigde of 2 interfaces, one interface in promisc mode (both interfaces are intel 82576, NAPI, LRO, RSS). Load on this brigde is 800mbps and 100 kpps (90%

Re: [pmacct-discussion] pre_tag_map issue + questions

2010-02-09 Thread Paolo Lucente
Hi Zenon, On Mon, Feb 08, 2010 at 02:43:49PM +0200, Zenon Mousmoulas wrote: records. If it's in there, then i'd like to give it a look myself: i would ask you to produce a trace and send it to me privately so that i can have a look. We can then summarize findings here. OK. I will send you

Re: [pmacct-discussion] pmacct count only 5% of SYN packets.

2010-02-09 Thread Paolo Lucente
Hi Yuriy, You have also other means to get a count of the TCP/SYN packets out of pmacct. I would suggest one for troubleshooing purposes with the goal to check where the issue lies: * keep the 'tcpflags' primitive out of the 'aggregate' directive * add a 'pcap_filter' directive to the config; it

[pmacct-discussion] Missing information in mysql table

2010-02-09 Thread Jonas Nylund
Hi, In logfile i see this Feb 9 16:47:46 oam02 sfacctd[14477]: DEBUG ( default/mysql ): INSERT INTO `acct_v5_06` (stamp_updated, stamp_inserted, vlan, src_port, dst_port, tos, ip_proto, agent_id, class_id, mac_src, mac_dst, ip_src, ip_dst, packets, bytes, flows) VALUES

Re: [pmacct-discussion] Missing information in mysql table

2010-02-09 Thread Paolo Lucente
Hi Jonas, On Tue, Feb 09, 2010 at 04:55:52PM +0100, Jonas Nylund wrote: [ ... ] mysql select * from acct_v5_06 limit 10;

Re: [pmacct-discussion] Enterasys nfacctd expecting flow error

2010-02-09 Thread marc slice
Paolo has provided the answer below. How sequencing works in NetFlow? Imagine you start from 0; imagine that you can pack a maximum of 30 flows within a NetFlow datagram: with 30 flows packed, the datagram is very close to 1500 bytes. The exact number of flows packed in a datagram depends on the