<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>My apologies for first sending this directly to the author instead of to a proper mailing list, which he took the time to set up. I am resending it to the list.</div><div><br class="webkit-block-placeholder"></div><div><br class="webkit-block-placeholder"></div> Good day! I'm a network engineer, smart guy, and Perl hacker at a smallish ISP in Charlottesville, Virginia, USA, and I'm trying to use flowd to put together a clever little client billing system. I believe everything is working fine, but when I turn on several routers' and several interfaces' worth of NetFlow packets toward this (reasonably powerful) Linux box at the same time, I get syslog messages like...<div><div><br></div><div><br class="webkit-block-placeholder"></div><div><font class="Apple-style-span" face="'Courier New'">Mar 26 20:13:27 chance flowd[17102]: Received max number of packets (512) on fd 3</font></div><div><font class="Apple-style-span" face="'Courier New'">Mar 26 20:13:27 chance flowd[17102]: Valid netflow v.5 packet 30 flows</font></div><div><font class="Apple-style-span" face="'Courier New'">Mar 26 20:13:27 chance flowd[17102]: Received max number of packets (512) on fd 3</font></div><div><font class="Apple-style-span" face="'Courier New'">Mar 26 20:13:27 chance flowd[17102]: Valid netflow v.5 packet 30 flows</font></div><div><font class="Apple-style-span" face="'Courier New'">Mar 26 20:13:27 chance flowd[17102]: Valid netflow v.5 packet 30 flows</font></div><div><font class="Apple-style-span" face="'Courier New'">Mar 26 20:13:27 chance flowd[17102]: Valid netflow v.5 packet 30 flows</font></div><div><br class="webkit-block-placeholder"></div>Does this mean that actual NetFlow data are being discarded because they are arriving too fast? I should warn you that I'm using a lot of flowd.conf "accept" rules (on the order of 1,300, and more coming next week), so is that a problem? I mainly want to know if all the data are being collected or not; if they are, I will recompile the code to just suppress this warning message, but if it's a real problem, I'd like to know if you have any suggestions for not dropping packets. I've attached the current flowd.conf in case you are interested, and if you want to see the Perl code or MySQL table structure behind the automated rule generation, I can show you that, too.</div><div><br class="webkit-block-placeholder"></div><div></div></body></html>