Sorry, pmacct correctly calculates SYNs. The problem was in duplicated
entries, this caused lost 95% of the data. This problem occurs only with
tables version 7 (which are used as IDS). For traffic calculation I use
a table version 1 without any problems. I've corrected the problem with
the
Hello.
I'm running Debian with vanila 2.6.32 kernel.
I've compiled pmacct 0.11.6 with pf_ring (transparent mode 1).
Packets pass through brigde of 2 interfaces, one interface in promisc
mode (both interfaces are intel 82576, NAPI, LRO, RSS).
Load on this brigde is 800mbps and 100 kpps (90%
Hi Yuriy,
You have also other means to get a count of the TCP/SYN packets out
of pmacct. I would suggest one for troubleshooing purposes with the
goal to check where the issue lies:
* keep the 'tcpflags' primitive out of the 'aggregate' directive
* add a 'pcap_filter' directive to the config; it
