Re: ng_netflow

On 7/10/14, 10:39 PM, Cristiano Deana wrote:
> On Thu, Jul 10, 2014 at 4:20 PM, Julian Elischer <[e-mail]> wrote:
>
> Hi, Julian
>
>> Is it possible that  you are working with an interface that has TSO on?
> it's a vlan interface, the device is a em0.
> net.inet.tcp.tso: 1
>
>> if so then netgraph will be seeing huge "aggregate" packets rather than the
>> normal packets.
>> so teh number of packets may be out by more than a factor of 30.
> My bigger problem is with traffic counter, but maybe it's just my error.
>
>> netgraph nodes are relatively simple..
> Not really :)
read this:
  http://people.freebsd.org/~julian/netgraph.html
>
> I have problems to find "easy" documentation about it. It's hard to
> understand what lower, upper, right, etc meaning. I think I could hav
> setup something wrong, maybe counting only incoming packet (or
> outgoing).
>
> I followed, not fully undestand, the example in ng_netflow man page:
>
>             /usr/sbin/ngctl -f- <<-SEQ
>                     mkpeer fxp0: netflow lower iface0
>                     name fxp0:lower netflow
>                     connect fxp0: netflow: upper out0
>                     mkpeer netflow: ksocket export inet/dgram/udp
>                     msg netflow:export connect inet/10.0.0.1:4444
>             SEQ
>
> Thank you
>

_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "[e-mail]"