[pmacct-discussion] Mikrotik Netflow: strange difference between nfacctd and nfcapd

Hi, I am exporting Netflow from 2 Mikrotik CCR (v9 but I also tried version 5) and trying to capture them with nfacctd. My config for testing: plugins: print !debug: true print_refresh_time: 300 print_output: json print_output_file: /tmp/nfacctd nfacctd_port: 2056 nfacctd_renormalize: true nfacc

Re: [pmacct-discussion] Timestamps and sample rates with L2 netflow v9

Hi Stephen, You can make nfacctd use as timestamp the time the flow is received by setting 'nfacctd_time_new: true'. I'm not entirely clear on the second question though; in an ideal world, where you have a different sampling rate per port and your device does report that correctly via NetFlow

Re: [pmacct-discussion] Mikrotik Netflow: strange difference between nfacctd and nfcapd

Hi Michael, I would suggest to comment out buffering, especially if the volume of NetFlow packets is not sustained (plugin_pipe_size, plugin_buffer_size); that should return a more accurate comparison. Should differences still persist, the course of action would be a unicast email to me with the