From owner-freebsd-stable@FreeBSD.ORG  Thu Jul 10 08:13:23 2014
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 9E710258;
 Thu, 10 Jul 2014 08:13:23 +0000 (UTC)
Received: from mail-vc0-x230.google.com (mail-vc0-x230.google.com
 [IPv6:2607:f8b0:400c:c03::230])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 5022B2EA0;
 Thu, 10 Jul 2014 08:13:23 +0000 (UTC)
Received: by mail-vc0-f176.google.com with SMTP id ik5so9762667vcb.35
 for <multiple recipients>; Thu, 10 Jul 2014 01:13:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:date:message-id:subject:from:to:content-type;
 bh=Dqp+RhJ3d5x5SArFjWRGNewVvxqL3Hv2vjX/dsHLQoU=;
 b=x6mw3IOKTEURsAce49ZBoXnUk7GyOeY/0XVwF4y/BeLDpxznaV05tzoTmkcCrlXK0e
 OjQ+HBY/10fW3Ogf4ggf5bO1AbQvCcZ4KGoh5zwIrCr4msNB4IXcvVdln5r0Nfrp07xB
 jamaCo+9nIvQovJAsebUKBLn+mez7x5wZ1U7sTeooEVxSq6so8T4jl39V4MIHiNQtCL8
 //F1FUfPrrYivtVoHvD+y5lds9vs5ED8mPLCeNpImwZyoshdVNlph2xT4QJz84m3KxlU
 9yCdZYlL0X3WZJ+00E0ujtpDEYFK3UUj5O5dGfhFDhbESRyJ6CdcBkCPS2QSmiVcF5JS
 w2XQ==
MIME-Version: 1.0
X-Received: by 10.220.177.133 with SMTP id bi5mr2051973vcb.26.1404980002338;
 Thu, 10 Jul 2014 01:13:22 -0700 (PDT)
Received: by 10.221.0.147 with HTTP; Thu, 10 Jul 2014 01:13:22 -0700 (PDT)
Date: Thu, 10 Jul 2014 10:13:22 +0200
Message-ID: <CAO82ECHDQTnFndHpaHKJTVZN4JJFUW=n4Sw82oO2sY1uNR_8Hw@mail.gmail.com>
Subject: ng_netflow
From: Cristiano Deana <cristiano.deana@gmail.com>
To: FreeBSD Stable Mailing List <freebsd-stable@freebsd.org>,
 FreeBSD net <freebsd-net@freebsd.org>
Content-Type: text/plain; charset=UTF-8
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Jul 2014 08:13:23 -0000

Hi all,

I have a bsd box as a router, with 4 vlan interfaces.
I started collecting flow data with softflowd and analyze them (in a
separate machine) with nfsen, but softflowd is taking too much cpu
(for the busiest interface up to 20%), so i tried to switch ONE
interface to ng_netflow.

I configured the same as the man page, but results are... odd.

Measure are wrong. I mean, graphs collected from softflowd show the
right amounts of packet/flows/data, the ones collected with ng_netflow
are wrong.
packets and flows are lower then expected, traffic is MUCH LOWER than
expected (1/10).

Any hint to debug or anyone with similar experience?

Thank you

-- 
Cris, member of G.U.F.I
Italian FreeBSD User Group
http://www.gufi.org/