Ahoy to you, Florian!
a single instance of pmacctd can't be bound to multiple interfaces.
This is common to many of the tools based on libpcap, mainly driven
by performance reasons.
Here you have two options, depending on your requirements (btw, can
you please explain in which scenario do you require to monitor two
interfaces, one for inbound, the other for outbound traffic?):
* you can run two instances of pmacctd. You can either keep things
in separate tables (memory, SQL) or join them into a single table
(SQL only). In the latter, you can further: keep things separate
by using different tags (post_tag will suffice) for each of the
instances or mix them. Simple enough.
* This is more elegant IHMO - the flip side of elegant things is
that can look complex at a first shot. You can use pmacct as a
NetFlow probe (pmacctd configured with a nfprobe plugin) on each
of the interfaces (two instances), intercepting the traffic of
interest, and collect everything back into a nfacctd listening
on the localhost. Here, you have some added advantage:
* distinguishing the flows generated by each probe can be done
with the Engine ID/Engine Type fields in the NetFlow header.
You can impose such values with the nfprobe_engine directive
and then tag them into the collector through the Pre-Tagging
infrastructure.
* you would have a wider choice in how to group/split your data
in your tables (both memory and SQL).
In both the above solution what remains to do is just distinguish
the direction of the traffic (ie. inbound, outbound). The only
option available here is to attach some filters to the probe as
we don't have access to the underlying SO structures. pcap_filter
directive does the job.
Cheers,
Paolo
On Mon, May 07, 2007 at 03:22:15PM +0200, Florian Arthofer wrote:
> Ahoy
>
> I wonder if it is possible to monitor two interfaces with pmacct.
> One for inbound and the other one for outbound traffic.
>
> If its possible: how do i do that? ;)
> Unfortunately i didn't find anything about that in the documentation i
> found.
>
> greetings
> flo
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
