Hi Axel, any chance the captured traffic is VLAN-tagged? If this is the case and the switch is providing such information through sFlow, then the 'aggregate_filter' should be re-written as 'vlan and ...'. Same is if it's MPLS-labelled 'mpls and ...'. If this is not the case, can you please send me privately a capture of a few sFlow datagrams in libpcap format - so that i can analyze them? Let me know.
Cheers, Paolo On Fri, Feb 06, 2009 at 06:13:43PM +0100, Axel Apitz wrote: > Hi All, > > i have a problem using aggregate_filter with sfacctd. > may be i have have understand something wrong ... > > I use the following Configuration to collect Inbound traffic > -- > debug: true > daemonize: true > logfile: /um/var/log/pmacct.log > networks_file: /um/etc/networks.def > plugins: print[umShared-inbound] > print_refresh_time: 5 > aggregate[umShared-inbound]: dst_net > aggregate_filter[umShared-inbound]: dst net 94.198.56.0 mask 255.255.255.0 > -- > > But sfacctd show no data. Can i not use aggregate_filter on sflow data ? > If i remove the aggregate_filter-Config-Line it work ... but i get all > the crap i am not interested on. > > Best Regards, > Axel Apitz > > -- > Axel Apitz > > The unbelievable Machine Company GmbH > Grolmanstr. 40 > 10623 Berlin > Tel.: +49 - 30 - 8892656 - 15 > Fax.: +49 - 30 - 8892656 - 11 > Mobile: +49 - 172 - 7300539 > > http://www.unbelievable-machine.com _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
