Hello there; I have a problem with probing promisc interface; In my situation there is a PC which interface is connected to span port of the switch (Vlan tagged); I''ve created vlan interface and run softflowd with appropriate switch (-i eth0.10); SWITCH (mirroring port) ----- eth0.10 | eth1 ------ collector Everything works smoothly and collector (another PC) is receiving netflow v5 packets; The problem is that the ammount of traffic which is collected is much more smaller then the real interface load; there is about 100 mbps on the eth0.10 but flowtools on the collector shows that there is not more then ~30mbps; PC''s are Linux with Intel Gigabit (eth0), Intel FastEth (eth1) and Intel Gigabit (collector). i''d be thankfull for any hint; thanks in advance, gniewko
gniewko wrote:> Hello there; > > I have a problem with probing promisc interface; > In my situation there is a PC which interface is connected to span port > of the switch (Vlan tagged); I''ve created vlan interface and run > softflowd with appropriate switch (-i eth0.10); > > > SWITCH (mirroring port) ----- eth0.10 | eth1 ------ collector > > > Everything works smoothly and collector (another PC) is receiving > netflow v5 packets; The problem is that the ammount of traffic which is > collected is much more smaller then the real interface load; > there is about 100 mbps on the eth0.10 but flowtools on the collector > shows that there is not more then ~30mbps;What does "softflowctl statistics" say? You might also want to try the attached patch which adds some stats from libpcap itself. Remember that softflowd doesn''t (yet) understand 802.1q, so if the frames will be ignored if they are still tagged when it sees them. -d -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: softflowd-pcap-stats.diff Url: http://lists.mindrot.org/pipermail/netflow-tools/attachments/20050517/672d2267/attachment.ksh