Hello, I am trying to use sfacctd. I am receiving sflow packets from two Force10 routers. However the routers send sflow packets to a host which then forwards them to another host where I run sfacctd.
I receive a lot of warnings like: WARN: expecting flow '9210526' but received '5813156' collector=(null):2060 agent=192.168.1.1:1 WARN: expecting flow '7618226' but received '10013980' collector=(null):2060 agent=192.168.1.1:0 WARN: expecting flow '10013981' but received '7618227' collector=(null):2060 agent=192.168.1.1:0 WARN: expecting flow '13099151' but received '7581594' collector=(null):2060 agent=192.168.1.1:13 WARN: expecting flow '7581594' but received '13099152' collector=(null):2060 agent=192.168.1.1:13 The 192.168.1.1 is the address of the forwarding host. It seems that sflacctd takes the source address of udp packet as an agent address, which I think is incorrect. According to sflow specs the agent address is included in sflow protocol itself (see page 32 of http://sflow.org/sflow_version_5.txt ) and sfacctd should use this one instead. I think this is also the reason for the warnings (sfacctd actually thinks they are coming from the same source, but they are not). Regards, Juraj _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
