Re: [pmacct-discussion] dynamic IP

[Karl O. Pinc]

On 03/03/2010 03:51:25 AM, Jeff Welling wrote:
 Hey,
 
 Im finding that one of my ISPs changes my IP frequently. 


 Is there a way to get the actual IP to show up without having to
 specify
 it in an aggregate_filter line in the config?

Probably not, although I'm not thinking it through.  
You wouldn't want pmacct to have to lookup the
IP every time a datagram went through.

What I would do is detect the change in IP (via dhclient.conf
or pppoe or swatch or whatever) and use a script to re-write
the pmacct config file, with m4 doing the substitution to
get the IP number into the right places, and then restart pmacct.

Karl k...@meme.com
Free Software:  You don't pay back, you pay forward.
 -- Robert A. Heinlein


___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] Log output from pmacctd Ive never seen before

[Paolo Lucente]

Hi Jeff,

How often you get this message?

Every time you see it, you miss a packet. The way to read
that line is: libpcap passed only the first 37 bytes of
the datagram to pmacct; L4 appears to start at the 38th
octet; and you might have specified src_port or dst_port
in your aggregation method. 

By default pmacct snaplen for IPv4 packets is 68 bytes,
so imposing something explicit wouldn't help. It appears
the reason for such truncation is external - hence the
question at the beginning of this email.

Cheers,
Paolo


On Sun, Feb 28, 2010 at 11:56:50PM -0800, Jeff Welling wrote:
 Hello again all!
 
 Just recently I started seeing this line in my logs every couple of minutes;
 
 Feb 28 23:34:57 gir pmacctd[12915]: INFO ( default/core ): short IPv4
 packet read (37/38/frags). Snaplen issue ?
 
 Gir being the name of my gateway machine.
 Recent events include installation of an additional internet connection
 (dual-homed), and configuring pmacctd to monitor the new interface with
 basically the same setup as my other interface, and setting the
 interface to not auto-negotiate its speed because that was causing problems.
 
 Does this mean pmacct is missing information? Should the snaplen be
 increased, I dont think Im doing classification and CONFIG-KEYS says the
 defaults should be ok unless your using classification?
 
 Cheers,
 Jeff.
 
 ___
 pmacct-discussion mailing list
 http://www.pmacct.net/#mailinglists

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists