[netflow-tools] softflowd under FreeBSD measures too much traffic

[Damien Miller]

On Tue, 16 Jan 2007, Sebastian Schwerdhoefer wrote:

> Dear List,
> 
> I'm trying to set up an ip gateway with FreeBSD. For traffic
> accounting i'd like to use softflowd with pmacct
> (http://www.pmacct.net/). In my tests, softflowd seems to calculate
> other (false) values when it's directly sniffing on an interface
> (executed with "-i sis1"). The curious thing is, when softflowd
> analyzes a tcpdumped file, the values delivered by softflowd are
> correct!
> 
> Can anyone understand and/or explain this strange behavior?

Not without a debug trace from softflowd and a better description of
how you calculated a variance.

> I'm using the newest softflowd version. FreeBSD patches one file, softflowd.c.
> I appended the diff file ("patch-softflowd.c"). Could this be the
> fault?

Probably not, at least if you aren't monitoring pfflowd.

-d