Hello. 13.06.09, 12:08, "Joerg Goltermann" <go...@openbsd.org>:
> are you sure both versions are captured at the same time? Yes. > pflow(4) uses the counters from pf. Can you reproduce the > difference of 14? Yes, see attached file - i start softflowd and pflow capture at the same time, but get different results. This capture i make with your new patch. # date Mon Jun 15 11:02:40 MSD 2009 # /usr/local/sbin/softflowd -n 127.0.0.1:1234 -i vic0 # ifconfig pflow0 flowsrc 192.168.227.131 flowdst 127.0.0.1:4321 # flow-capture -w /var/spool/netflow/softflowd -N 0 0/0/1234 # flow-capture -w /var/spool/netflow/pflow -N 0 0/0/4321 # lynx www.openbsd.org .. (wait for log rotation by flow-capture, 15 mins) # date Mon Jun 15 11:15:53 MSD 2009 # flow-cat /var/spool/netflow/softflowd/ft* | flow-export -f 2 > softflowd.csv # flow-cat /var/spool/netflow/pflow/ft* | flow-export -f 2 > pflow.csv Just one question softflowd will expire flows after user-configurable periods. Can i configure expire period for pflow ? [demime 1.01d removed an attachment of type application/octet-stream which had a name of pflow.csv] [demime 1.01d removed an attachment of type application/octet-stream which had a name of softflowd.csv]
