Hi Jordan,
Outcome of our exchange was that it was actually not a bug; rather
packets were VLAN-tagged (and libpcap filters are sensible to both
VLAN tags and MPLS labels). So, in the end, the filter had to be
written as:
set_tag=4 ip=0.0.0.0/0filter='ip or (vlan and ip)'
set_tag=6
Hi Steve,
As Tim was mentioning you can use 'sampling_rate' with a fixed sample
rate (not 'sample_rate'); this will make pmacct sample for you. In case
you are sampling outside pmacct, you can supply this info via, say,
pmacctd_ext_sampling_rate so that nfprobe will include such value in
the
Hi Adrien,
Thanks for your kind words :)
pmacct client can perform basic filtering but not sub-aggregation.
This said, the first thing it came to mind reading your question was
to query the memory table as "pmacct -s -O csv" then use a few touches
of awk for the sub-aggregation. Like:
For
Dear all,
[first, thanks to pmacct authors for this very nice tool :) ]
I am trying to use pmacct 1.6 daemon within a 8MB flash / 64MB RAM 3G
OpenWRT router (MIPS/AR9341 platform). In order to aggregate conveniently
the statistics (e.g. for ingress traffic I can group by destination IP, and
for
Hi Paolo,
I looked thru the CONFIG_KEYS and didn't find the ability to do sampling except
in the SQL_preprocess keys. Is it possible to do the sampling at the point
the neflow records are first created - in other words by nfprobe?
Thanks,
Steve
--
"They that give up essential liberty to
If the probe is doing sampling, you can have pmacct re-normalize sampling
via either a static sampling value, or via the flow/ipfix information that
tells it how it was sampled..
sample_rate:
sample_map:
(s|n|p|u)facctd_renormalize:true
If you're using a tap that samples traffic, you can tell
Hi Tim,
My question is can nfprobe from pmacct package do the sampling at the
origination of the flow.
Thanks,
Steve
On 08/24/2016 10:55 AM, Tim Jackson wrote:
If the probe is doing sampling, you can have pmacct re-normalize sampling via
either a static sampling value, or via the flow/ipfix
