Hi All, We use pflow with pf to export packets to a collector for billing/monitoring purposes. The problem we have is that someone at the weekend had a very long running scp connection over several days that transferred a TB of data. The data was not logged via pflow until the state expired, so then showed a massive spike when the state expired.
Anyone know any way around this? Is it possible to get pf/pflow to export more regularly? Or set some timeout? I'm guessing not due to the architecture, and unless I force pf states to timeout then I'm stuck? But thought I'd ask in case anyone knew of a way. Thanks -Matt
