[netflow-tools] softflowd

[Damien Miller]

gniewko wrote:
> Hello there;
> 
> I have a problem with probing promisc interface;
> In my situation there is a PC which interface is connected to span port
> of the switch (Vlan tagged); I've created vlan interface and run
> softflowd with appropriate switch (-i eth0.10); 
> 
> 
> SWITCH (mirroring port) ----- eth0.10 | eth1 ------ collector
> 
> 
> Everything works smoothly and collector (another PC) is receiving
> netflow v5 packets; The problem is that the ammount of traffic which is
> collected is much more smaller then the real interface load;
> there is about 100 mbps on the eth0.10 but flowtools on the collector
> shows that there is not more then ~30mbps;

What does "softflowctl statistics" say? You might also want to try the
attached patch which adds some stats from libpcap itself.

Remember that softflowd doesn't (yet) understand 802.1q, so if the
frames will be ignored if they are still tagged when it sees them.

-d
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: softflowd-pcap-stats.diff
Url: http://lists.mindrot.org/pipermail/netflow-tools/attachments/20050517/672d2267/attachment.ksh