Date: Thu, 10 Jul 2014 22:20:21 +0800 From: Julian Elischer <julian@freebsd.org> To: Cristiano Deana <cristiano.deana@gmail.com>, FreeBSD Stable Mailing List <freebsd-stable@freebsd.org>, FreeBSD net <freebsd-net@freebsd.org> Subject: Re: ng_netflow Message-ID: <53BEA125.6010400@freebsd.org> In-Reply-To: <CAO82ECHDQTnFndHpaHKJTVZN4JJFUW=n4Sw82oO2sY1uNR_8Hw@mail.gmail.com> References: <CAO82ECHDQTnFndHpaHKJTVZN4JJFUW=n4Sw82oO2sY1uNR_8Hw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 7/10/14, 4:13 PM, Cristiano Deana wrote: > Hi all, > > I have a bsd box as a router, with 4 vlan interfaces. > I started collecting flow data with softflowd and analyze them (in a > separate machine) with nfsen, but softflowd is taking too much cpu > (for the busiest interface up to 20%), so i tried to switch ONE > interface to ng_netflow. > > I configured the same as the man page, but results are... odd. > > Measure are wrong. I mean, graphs collected from softflowd show the > right amounts of packet/flows/data, the ones collected with ng_netflow > are wrong. > packets and flows are lower then expected, traffic is MUCH LOWER than > expected (1/10). > > Any hint to debug or anyone with similar experience? Is it possible that you are working with an interface that has TSO on? if so then netgraph will be seeing huge "aggregate" packets rather than the normal packets. so teh number of packets may be out by more than a factor of 30. I have never used the ng_netflow node, but try turning off TSO if you have it on and see if that makes a difference. failing that you might just look a the source of the ng_netflow module (ng_netflow.c) for ideas. netgraph nodes are relatively simple.. they have an entry point where packets turn up and they call the same method in some other module.. > > Thank you >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53BEA125.6010400>