Dear List, Using Debian Etch with a customized kernel 2.6.22.6 (in bridge mode)
I am testing pmacct with using the following configurations: -------------------------------------------------------------- plugins: memory[inbound], memory[outbound] aggregate[inbound]: dst_host aggregate[outbound]: src_host aggregate_filter[inbound]: dst net 10.10.20.0/24 aggregate_filter[outbound]: src net 10.10.20.0/24 imt_path[inbound]: /tmp/pmacct_inbound.pipe imt_path[outbound]: /tmp/pmacct_outbound.pipe plugin_buffer_size: 50240 plugin_pipe_size: 50240000 imt_buckets: 65537 imt_mem_pools_size: 1024000 --------------------------------------------------------------- and storing results in files every 10 minutes: $pmacct_command -s -e -p /tmp/pmacct_outbound.pipe > $current_fileOUT $pmacct_command -s -e -p /tmp/pmacct_inbound.pipe > $current_fileIN To verify if pmacct is storing/keeping track of data accurately, I send a large file and measure transfered bandwidth using three softwares. So far IPTABLES counters is more accurate than any software based on the pcap library: Software IN OUT IPTABLES 763400472 763280155 IPFM 529312262 521032723 PMACCT 754710867 635582251 The file that I sent across the bridge was 726,325,248 bytes IN/OUT in around ~ 2 Minutes Here is my question: What else should I adjust in order to get accuracy when using pmacct? I thought that with plugin_pipe_size: 50240000 , I had plenty of space in the circular queue, so the core process could capture all the packets. Regards, Mario Antonio _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
