Hi Olaf,
On Sat, Sep 17, 2011 at 11:05:02AM +1000, Olaf de Bree wrote:
I have nfacctd up and running and it is receiving flows from my test
router.
when doing a debug i can see #95 field arrive in the net flow template (see
debug below)
[ ... ]
What i really not sure of is how to filter or report on the #95 (Application
ID) field on incoming flows and also store in a DB
Great, it all looks good so far. I suggest to modify the following aggregation
method:
aggregate: src_host, dst_host, src_port, dst_port, proto
into:
aggregate: sum_host, class
To start with and verify whether it works. Then you will probably reckon some
non-local IP addresses popping up in your accounting (ie. youtube server): my
guess is you might not be interested into these and hence you might want to
filter in only local networks. Two strategies to accomplish this (read docs
for further information) are: aggregate_filter or networks_file.
Let me know how it goes.
Cheers,
Paolo
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
