Hi Alan, On Fri, Mar 16, 2007 at 09:27:34AM -0700, Alan wrote:
> I've run tcpdump on both hosts with the filters in it from the pmacct > settings above and the bytes that are caught by tcpdump match properly, > however the values that are written by pmacctd to the respective > databases are consistantly double in #2 :( > > Could this be the aggregate[] setting maybe? I can't see something like > that doubling what pmacctd is recording, but who knows. Any suggestions > or tips *greatly* appreciated. I think the aggregate should not make any difference here. How are you getting packets off the wire in your #2 setup? Is that the traffic is accounted while getting through the box? In this case try adding to your config a "promisc: false". Or is that eth3 is attached to a mirroring port aswell? In this case it smells like the mirroring setup could be not configured properly on the switch, ie. length of the packets match, did you also verify whether packets are received twice? Let me know. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
