Ahoy Paolo ;) Thanks for your fast response. I think the option with the two pmacctd instances will do it for now.
Because you're interested in my setup: I've got here a little network-tap with 4 ports. The first two ports are for looping through the traffic, the other two then will "mirror" the traffic. These two "mirror-ports" are connected to our accounting-machine. So, at the end, i've got one port with inbound-traffic and the other with outbound traffic. (i hope this explanation is good enough ;) ). The network-tap is this one: http://netoptics.com/products/product_family_details.asp?cid=1&pid=159&Section=products&menuitem=1&tag=NetOptics+Network+Taps greetings flo On Mon, 2007-05-07 at 21:34 +0100, Paolo Lucente wrote: > Ahoy to you, Florian! > a single instance of pmacctd can't be bound to multiple interfaces. > This is common to many of the tools based on libpcap, mainly driven > by performance reasons. > Here you have two options, depending on your requirements (btw, can > you please explain in which scenario do you require to monitor two > interfaces, one for inbound, the other for outbound traffic?): > > * you can run two instances of pmacctd. You can either keep things > in separate tables (memory, SQL) or join them into a single table > (SQL only). In the latter, you can further: keep things separate > by using different tags (post_tag will suffice) for each of the > instances or mix them. Simple enough. > > * This is more elegant IHMO - the flip side of elegant things is > that can look complex at a first shot. You can use pmacct as a > NetFlow probe (pmacctd configured with a nfprobe plugin) on each > of the interfaces (two instances), intercepting the traffic of > interest, and collect everything back into a nfacctd listening > on the localhost. Here, you have some added advantage: > > * distinguishing the flows generated by each probe can be done > with the Engine ID/Engine Type fields in the NetFlow header. > You can impose such values with the nfprobe_engine directive > and then tag them into the collector through the Pre-Tagging > infrastructure. > > * you would have a wider choice in how to group/split your data > in your tables (both memory and SQL). > > In both the above solution what remains to do is just distinguish > the direction of the traffic (ie. inbound, outbound). The only > option available here is to attach some filters to the probe as > we don't have access to the underlying SO structures. pcap_filter > directive does the job. > > Cheers, > Paolo > > On Mon, May 07, 2007 at 03:22:15PM +0200, Florian Arthofer wrote: > > Ahoy > > > > I wonder if it is possible to monitor two interfaces with pmacct. > > One for inbound and the other one for outbound traffic. > > > > If its possible: how do i do that? ;) > > Unfortunately i didn't find anything about that in the documentation i > > found. > > > > greetings > > flo -- Florian Arthofer Technik Web- und Mailservices/Administrator Web- and Mailservices lagis Internet Serviceprovider GmbH Wiener Straße 151, 4021 Linz, Austria Phone +43(0)732/3400-5636 Fax +43(0)732/3400-5644 E-Mail [EMAIL PROTECTED] URL http://www.lagis.at FN 270805 w des Landesgerichtes Linz _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
