From owner-freebsd-stable@FreeBSD.ORG  Sun Jul 13 23:50:43 2014
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 863D9CD8;
 Sun, 13 Jul 2014 23:50:43 +0000 (UTC)
Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "vps1.elischer.org",
 Issuer "CA Cert Signing Authority" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 57C8924F2;
 Sun, 13 Jul 2014 23:50:43 +0000 (UTC)
Received: from jre-mbp.elischer.org
 (ppp121-45-250-191.lns20.per2.internode.on.net [121.45.250.191])
 (authenticated bits=0)
 by vps1.elischer.org (8.14.9/8.14.9) with ESMTP id s6DNodKR070525
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO);
 Sun, 13 Jul 2014 16:50:41 -0700 (PDT)
 (envelope-from julian@freebsd.org)
Message-ID: <53C31B49.4060201@freebsd.org>
Date: Mon, 14 Jul 2014 07:50:33 +0800
From: Julian Elischer <julian@freebsd.org>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
To: Cristiano Deana <cristiano.deana@gmail.com>
Subject: Re: ng_netflow
References: <CAO82ECHDQTnFndHpaHKJTVZN4JJFUW=n4Sw82oO2sY1uNR_8Hw@mail.gmail.com>	<53BEA125.6010400@freebsd.org>
 <CAO82ECEk49JpgMLQa51iabA5dvF=Q=T__7-drVOmmXhRDCKuzQ@mail.gmail.com>
In-Reply-To: <CAO82ECEk49JpgMLQa51iabA5dvF=Q=T__7-drVOmmXhRDCKuzQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: FreeBSD net <freebsd-net@freebsd.org>,
 FreeBSD Stable Mailing List <freebsd-stable@freebsd.org>
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable/>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Jul 2014 23:50:43 -0000

On 7/10/14, 10:39 PM, Cristiano Deana wrote:
> On Thu, Jul 10, 2014 at 4:20 PM, Julian Elischer <julian@freebsd.org> wrote:
>
> Hi, Julian
>
>> Is it possible that  you are working with an interface that has TSO on?
> it's a vlan interface, the device is a em0.
> net.inet.tcp.tso: 1
>
>> if so then netgraph will be seeing huge "aggregate" packets rather than the
>> normal packets.
>> so teh number of packets may be out by more than a factor of 30.
> My bigger problem is with traffic counter, but maybe it's just my error.
>
>> netgraph nodes are relatively simple..
> Not really :)
read this:
  http://people.freebsd.org/~julian/netgraph.html
>
> I have problems to find "easy" documentation about it. It's hard to
> understand what lower, upper, right, etc meaning. I think I could hav
> setup something wrong, maybe counting only incoming packet (or
> outgoing).
>
> I followed, not fully undestand, the example in ng_netflow man page:
>
>             /usr/sbin/ngctl -f- <<-SEQ
>                     mkpeer fxp0: netflow lower iface0
>                     name fxp0:lower netflow
>                     connect fxp0: netflow: upper out0
>                     mkpeer netflow: ksocket export inet/dgram/udp
>                     msg netflow:export connect inet/10.0.0.1:4444
>             SEQ
>
> Thank you
>