From maxframes at hotmail.com Tue Feb 10 19:53:53 2015 From: maxframes at hotmail.com (MaxFrames) Date: Tue, 10 Feb 2015 09:53:53 +0100 Subject: [netflow-tools] Problem with softflowd since upgrading to pfsense 2.2 (freebsd 10) Message-ID: I used to run softflowd on pfsense 2.1.x (which was based upon freebsd 8) to send flow data to a prtg collector. Recently I have upgraded to pfsense 2.2 (which is based upon freebsd 10) and I am encountering an issue. softflowd does listen on the assigned interface, but it seems to send no flow data to the collector when the traffic on the interface is particularly sparse. I cannot be more precise, but when there's just a minimum of activity on the interface (I cannot put my finger on it, it may be related to the number of packets or to their size) softflowd seems to skip creating flows and/or to send them to the collector. If this goes on for more than the timeout value on the collector, the collector will report a warning on the sensor ("no data since..."). As soon as there is some substantial activity on the interface (for example, I can trigger this by initiating a large download), flow data are once again sent to the collector. It may or may not be related to libpcap. By all means, this issue was not present with pfsense 2.1: regardless of the activity on the interface, some flow data was always sent to the collector. I have found evidence of the same problem on freebsd 9.x, so it would seem that all was OK up to 8.x: https://forums.freebsd.org/threads/cannot-get-flows-again.42523/ Thanks in advance, I hope it can be fixed without rolling back to an older version of pfsense; best regards -- MaxFrames From aaronc at morad.ab.ca Wed Feb 18 07:50:03 2015 From: aaronc at morad.ab.ca (Aaron Cherman) Date: Tue, 17 Feb 2015 13:50:03 -0700 Subject: [netflow-tools] pfflowd and FreeBSD 10.1 Message-ID: <54E3A97B.3060902@morad.ab.ca> An HTML attachment was scrubbed... URL: