On 2009/06/13 10:08, Joerg Goltermann wrote: > Hello, > > ???????????? ???????????????????? wrote: > > patch works, but i note some differences in same traffic > > (see attached files in my previous message) > > > > 1. softflowd captured 7 records, pflowd at the same time captured 8 > > pflow(4) captured one additional flow (line #9) from xxx > Port 137 to yyy Port 137. > > > 2. different quantity of octets in reply from openbsd.org webserver: > > pflow.csv, line #6: 7107 octets > > softflowd.csv, line #5: 7121 octet > > are you sure both versions are captured at the same time? > pflow(4) uses the counters from pf. Can you reproduce the > difference of 14?
softflowd doesn't send states immediately, only when the PF state has timed out.
