Date: Mon, 14 Jul 2014 07:50:33 +0800 From: Julian Elischer <julian@freebsd.org> To: Cristiano Deana <cristiano.deana@gmail.com> Cc: FreeBSD net <freebsd-net@freebsd.org>, FreeBSD Stable Mailing List <freebsd-stable@freebsd.org> Subject: Re: ng_netflow Message-ID: <53C31B49.4060201@freebsd.org> In-Reply-To: <CAO82ECEk49JpgMLQa51iabA5dvF=Q=T__7-drVOmmXhRDCKuzQ@mail.gmail.com> References: <CAO82ECHDQTnFndHpaHKJTVZN4JJFUW=n4Sw82oO2sY1uNR_8Hw@mail.gmail.com> <53BEA125.6010400@freebsd.org> <CAO82ECEk49JpgMLQa51iabA5dvF=Q=T__7-drVOmmXhRDCKuzQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 7/10/14, 10:39 PM, Cristiano Deana wrote: > On Thu, Jul 10, 2014 at 4:20 PM, Julian Elischer <julian@freebsd.org> wrote: > > Hi, Julian > >> Is it possible that you are working with an interface that has TSO on? > it's a vlan interface, the device is a em0. > net.inet.tcp.tso: 1 > >> if so then netgraph will be seeing huge "aggregate" packets rather than the >> normal packets. >> so teh number of packets may be out by more than a factor of 30. > My bigger problem is with traffic counter, but maybe it's just my error. > >> netgraph nodes are relatively simple.. > Not really :) read this: http://people.freebsd.org/~julian/netgraph.html > > I have problems to find "easy" documentation about it. It's hard to > understand what lower, upper, right, etc meaning. I think I could hav > setup something wrong, maybe counting only incoming packet (or > outgoing). > > I followed, not fully undestand, the example in ng_netflow man page: > > /usr/sbin/ngctl -f- <<-SEQ > mkpeer fxp0: netflow lower iface0 > name fxp0:lower netflow > connect fxp0: netflow: upper out0 > mkpeer netflow: ksocket export inet/dgram/udp > msg netflow:export connect inet/10.0.0.1:4444 > SEQ > > Thank you >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53C31B49.4060201>