[netflow-tools] softflowctl statistics

[Michael W. Lucas]

Hi,

(Please pardon the nitpicking questions.  My new book includes a
section on softflowd.  While I've used softflowd happily for years,
this means that I'm now poking into corners that I've never looked at
before.)

I'm taking a close look at "softflowctl statistics," and something
doesn't seem quite right to me.  Here's output from 0.9.8 on a FreeBSD
6.4 test box:

softflowd[61946]: Accumulated statistics:
Number of active flows: 16
Packets processed: 11898
Fragments: 0
Ignored packets: 46 (46 non-IP, 0 too short)
Flows expired: 759 (0 forced)
Flows exported: 784 in 67 packets (0 failures)
Packets received by libpcap: 12156
Packets dropped by libpcap: 0
Packets dropped by interface: 3217012028

I would expect "packets processed" + "ignored packets" = "packets
received by libpcap".  This rarely seems to be the case.  Does
softflowd lose packets?

Also, we've expired 759 flows, but exported 784.  Where did the extra
25 flows come from?

What makes softflowd "force" expiration of a flow?  "softflowctl
expire-all" doesn't seem to increment this counter.

Last, why would an interface on a machine with very little traffic
show 3217012028 packets dropped by the interface?

Thanks,
==ml

==ml

-- 
Michael W. Lucas 	mwlucas at BlackHelicopters.org, mwlucas at FreeBSD.org
		http://www.BlackHelicopters.org/~mwlucas/
"My pessimism extends to the point of even suspecting the sincerity of
  the pessimists." -- Jean Rostand, French biologist and philosopher