I notice with multiple interfaces that I get duplicate flows. If I recall
correctly a cisco router does netflow only on input while it seems pcap
captures both inbound outbound packets. My work around to filter out
the output flows was to use a pcap_filter such as:
!
daemonize: true
promisc:
Hi Stig,
Very briefly to confirm: a) you are correct, libpcap captures
both inbound and outbound traffic and b) the workaround you
have put in place not only makes sense but is also by far the
most efficient way to filter traffic out of pmacctd.
Cheers,
Paolo
On Tue, Aug 04, 2009 at 10:39:00AM
