Dnia środa, 7 lutego 2007 17:11, Fabrizio Vecchi napisał: > Jakub Wartak wrote: > > You are running in promisc mode but what is your topology ? > > Well, this is an MPLS router which connects the branches of my business. > I am monitoring the ethernet interface of the centre-star router, and > this interface is bound on the same switch where my linux box is bound too. > > > You are capturing traffic some switch with port mirroring ( maybe you are > > mirroring only one side of traffic - tx o rx ? ) > > I am sniffing the traffic from a port which mirrors the port which the > router is bound to, so I think I am monitoring both sides of all the > traffic generated by the router, is it correct?
It should be correct, but some switches allow to mirror for example only rx or tx or both sides of some ethernet ports - therefore i'm asking.. I were You i would install some bandwidth meter ( like iptraf, staktools, ethstats or something like that ) and measure traffic. Later i would compare it to the switch statistics on ports to the router and to the pmacct-machine, and then to the router... Hope that helps. -- Jakub Wartak -vnull http://vnull.pcnet.com.pl/ _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
