Hi Sebastian, a couple of things come to my mind - let me know if you have any joy with them: - Ethereal could be counting packet sizes differently compared to pmacct. pmacct counts IPv4/6 header's length plus the payload. ie.m L2 and ethernet-related stuff are excluded. If this is the case, number of packets should be roughly the same. - Is any of plugin_buffer_size or plugin_pipe_size enabled? If that's the case then pmacct buffers could be affecting your totals (ie. at any time a certain quantity of packets are still held in the buffer). To adjust this, you should gracefully terminate pmacct, ie. "killall -INT pmacctd".
Also, don't forget to compare what Ethereal and pmacct say with any third-party software. As a last resort, if none of the above is successfull, can you send me a reasonable captured file together with the counters (packets and bytes) from both Ethereal and pmacct? I'll investigate the problem, also comparing them with different platforms (as i don't have access to any FreeBSD 6.x). Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
