Date: Thu, 10 Jul 2014 16:39:10 +0200 From: Cristiano Deana <cristiano.deana@gmail.com> To: Julian Elischer <julian@freebsd.org> Cc: FreeBSD net <freebsd-net@freebsd.org>, FreeBSD Stable Mailing List <freebsd-stable@freebsd.org> Subject: Re: ng_netflow Message-ID: <CAO82ECEk49JpgMLQa51iabA5dvF=Q=T__7-drVOmmXhRDCKuzQ@mail.gmail.com> In-Reply-To: <53BEA125.6010400@freebsd.org> References: <CAO82ECHDQTnFndHpaHKJTVZN4JJFUW=n4Sw82oO2sY1uNR_8Hw@mail.gmail.com> <53BEA125.6010400@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jul 10, 2014 at 4:20 PM, Julian Elischer <julian@freebsd.org> wrote:
Hi, Julian
> Is it possible that you are working with an interface that has TSO on?
it's a vlan interface, the device is a em0.
net.inet.tcp.tso: 1
> if so then netgraph will be seeing huge "aggregate" packets rather than the
> normal packets.
> so teh number of packets may be out by more than a factor of 30.
My bigger problem is with traffic counter, but maybe it's just my error.
> netgraph nodes are relatively simple..
Not really :)
I have problems to find "easy" documentation about it. It's hard to
understand what lower, upper, right, etc meaning. I think I could hav
setup something wrong, maybe counting only incoming packet (or
outgoing).
I followed, not fully undestand, the example in ng_netflow man page:
/usr/sbin/ngctl -f- <<-SEQ
mkpeer fxp0: netflow lower iface0
name fxp0:lower netflow
connect fxp0: netflow: upper out0
mkpeer netflow: ksocket export inet/dgram/udp
msg netflow:export connect inet/10.0.0.1:4444
SEQ
Thank you
--
Cris, member of G.U.F.I
Italian FreeBSD User Group
http://www.gufi.org/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAO82ECEk49JpgMLQa51iabA5dvF=Q=T__7-drVOmmXhRDCKuzQ>