Hi Mario Antonio, sorry for getting back to you so late. There have been a few reports in the past pretty in line with what you are outlining in your email. The root of the problem seems to relate somehow to bridged interfaces and libpcap on Linux systems - nothing specifically related to pmacct.
I see in your config you are not specifying any interface - leaving the SO to pick one for you; can you please play around this setting and see if you get any benefit by forcing capturing packets off the bridged interface itself or either the physical interfaces part of the logical bridge? Cheers, Paolo On Fri, Nov 02, 2007 at 07:48:03PM -0400, Mario Antonio Garcia wrote: > Using Debian Etch with a customized kernel 2.6.22.6 (in bridge mode) > > I am testing pmacct with using the following configurations: > > -------------------------------------------------------------- > plugins: memory[inbound], memory[outbound] > aggregate[inbound]: dst_host > aggregate[outbound]: src_host > aggregate_filter[inbound]: dst net 10.10.20.0/24 > aggregate_filter[outbound]: src net 10.10.20.0/24 > imt_path[inbound]: /tmp/pmacct_inbound.pipe > imt_path[outbound]: /tmp/pmacct_outbound.pipe > plugin_buffer_size: 50240 > plugin_pipe_size: 50240000 > imt_buckets: 65537 > imt_mem_pools_size: 1024000 > --------------------------------------------------------------- > > [ ... ] > > What else should I adjust in order to get accuracy when using pmacct? > I thought that with plugin_pipe_size: 50240000 , I had plenty of space in the > circular queue, so the core process could capture all the packets. _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
