Hi Thomas, On Fri, Sep 01, 2006 at 11:00:24AM +0200, Thomas Stegbauer wrote:
> today src_as and dst_as get filled, but the values are mixed up. > so in src_as stands the as which should be dst_as and vice versa. Mmmh. Sounds strange. I need you to elaborate this a bit more. Can you please reproduce the issue and feed me (i'd say privately) the following material: - version of pmacct - screenshot containing the mixed src_as/dst_as - your configuration file - any further commandline parameter - your networks_file, in case you are using one - are you using 'nfprobe' plugin to generate NetFlow data? - if possible, a short tcpdump trace of your NetFlow datagrams (it should make evident the ASN mix - say, having face to face these captured datagrams and the forementioned screenshot) > yes like here Q4: > http://inet-lab.naist.jp/measurement/NetFlow2MySQL/FAQ.html Ok. Actually there isn't such chance in pmacct. Only pmacctd is able to detect packet loss, through libpcap. Because both sFlow and NetFlow have strictly incremental sequence numbers, it would be easy enough to log (where logs actually go either console or syslog) such anomalies whenever they happen. Would such a plan fit for you (and others reading interested into this point) ? I already had it planned this way in my todo list. Maybe i could take the occasion to converge on it shortly ... > i am fairly new to postgresql, what sql-queries are possible to a field > from type inet? > > i had this on mysql, where the ip-addresses got saved as number's > SELECT 'input' AS typf, ipv4_dst_addr as ip, SUM(bytes) AS summe > FROM record > WHERE ((ipv4_dst_addr BETWEEN 3232235520 AND 3232235775) > or (ipv4_dst_addr BETWEEN 167772160 and 167772415)); Well, a query like the following one would work fine (maybe mine it's an incomplete answer and you would like to take a look to PostgreSQL docs which are usually comprehensive and detailed): SELECT * FROM acct_v6 WHERE ip_dst BETWEEN '192.168.1.1' AND '192.168.255'; Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
