[netflow-tools] softflowd under FreeBSD measures too much traffic

[Sebastian Schwerdhoefer]

Dear List,

I'm trying to set up an ip gateway with FreeBSD. For traffic
accounting i'd like to use softflowd with pmacct
(http://www.pmacct.net/). In my tests, softflowd seems to calculate
other (false) values when it's directly sniffing on an interface
(executed with "-i sis1"). The curious thing is, when softflowd
analyzes a tcpdumped file, the values delivered by softflowd are
correct!

Can anyone understand and/or explain this strange behavior?

I'm using the newest softflowd version. FreeBSD patches one file, softflowd.c.
I appended the diff file ("patch-softflowd.c"). Could this be the
fault?

Thanks in advance!
Sebastian Schwerdhöfer
-------------- next part --------------
A non-text attachment was scrubbed...
Name: patch-softflowd.c
Type: text/x-csrc
Size: 398 bytes
Desc: not available
Url : http://lists.mindrot.org/pipermail/netflow-tools/attachments/20070116/1748ec1e/attachment.bin