I've been using sfacctd extensively for quite some time, and have never run across an issue where the values it returned were wildly inaccurate. I'm sure this is a configuration snafu on my part, however I simply can't find it.
I've got a collector that collects for two large routers; my AS and MAC aggregate numbers are flawless, however I also need to graph throughput and pps for a single IP address (our IRC server). The interface counters report 800Kbps in throughput and around 300-400pps, however deriving these values from sflow I get about a tenth of that. The routers sample egress only and therefore I have tripled checked to make sure all ports passing traffic are also being sampled. Using sflowtool, I see many more sflow datagrams with the dstIP I'm interested in, as well as the proper outputPort ifIndex value - hence why I'm wondering if this is a strange pmacct thing. any ideas? thanks, aaron _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
