Hi Fernando, Thanks very much for appreciating the tool. Regarding the warning message: it depends. It tells you that basing on the sequence numbers, pmacct was expecting a NetFlow packet with sequence number '1980' but got one with sequence number '0'.
It might be an issue with the NetFlow re-generator or the original NetFlow agent was restarted - thus causing a reset of the sequence number. This is just guessing but you might very likely verify it by capturing the NetFlow stream as it's being delivered to pmacct with tcpdump and then analyze sequence numbers behaviour. I would assume if there would be packet loss somewhere (either in the original NetFlow stream or the replicated one) you would see small backward/forward jumps in the sequence numbers but definitely not a 1980 -> 0 sort of behaviour. Cheers, Paolo On Tue, Sep 23, 2008 at 01:04:12AM -0300, Fernando Lunardelli wrote: > Hi, pmacct is a really impressive tool and has a lot of tweak options. > > I'm working to setup a large netflow infrastructure, but I still get > some troubles, with a very high cpu load on database operations. > > tweak, tweak, tweak ;) > > Well, I wrote a very "quick'n'dirt" shell script to execute flow-gen > (flow-tools) and send packets to nfacctd. Everything looks very well, > except for some warning messages in log file: > > WARN: expecting flow '1980' but received '0' collector=0.0.0.0:2100 > agent=127.0.0.1:0 > > > Should I care about ? (please, 1980 is not my birth year ;) > > ------------------------------------------ netflow-torture.sh > -------------------------------------------------------------- > > #!/bin/sh > NUMFLOWPACKETS=2000 > FLOWVERSION=5 > FLOWRECEIVER="0/127.0.0.1/2100" > INTERVAL=1 > > counter=1 > while true; do > echo "#$counter - $(date +%c) - Sending $NUMFLOWPACKETS flow > packets to ($FLOWRECEIVER)" > flow-gen -V $FLOWVERSION -n $NUMFLOWPACKETS | flow-send $FLOWRECEIVER > counter=$(($counter + 1)) > sleep $INTERVAL > done _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
