I want to measure traffic for network 192.168.0.0/23
to outside Internet. Network 192.168.0.0/23 are
connected to router/nat through cisco switch 2900:
192.168.0.0/23----2900---nat/router---Internet
Port of switch connected to nat/router is mirrored to
linux box with pmacctd. Everything looks ok but
traffic measured by pmacctd is doubled. If host with
IP address 192.168.0.8 download file with size of 66
MB pmacct show:
#pmacct -s -p /tmp/pipe.out
DST IP PACKETS BYTES
192.168.0.8 89892 132060817
Configuration file is:
!
! pmacct: In + Out
!
debug: false
daemonize: true
interface: eth2
plugin_buffer_size: 2048
plugin_pipe_size: 2048000
plugins: memory[in], memory[out]
aggregate[in]: src_host
aggregate[out]: dst_host
aggregate_filter[in]: dst net !192.168.0.0/23
aggregate_filter[out]: src net !192.168.0.0/23
imt_path[in]: /tmp/pipe.in
imt_path[out]: /tmp/pipe.out
Where I made mistake?
______________________________________________________
Click here to donate to the Hurricane Katrina relief effort.
http://store.yahoo.com/redcross-donate3/
