Hi Paolo, many thanks for the quick response. You hit the problem. The traffic is VLAN tagged. Changing the statement to 'vlan and ...' solved the problem.
Many thanks Best Regards Axel Apizt 2009/2/6 Paolo Lucente <[email protected]>: > Hi Axel, > > any chance the captured traffic is VLAN-tagged? If this is the case > and the switch is providing such information through sFlow, then the > 'aggregate_filter' should be re-written as 'vlan and ...'. Same is > if it's MPLS-labelled 'mpls and ...'. If this is not the case, can > you please send me privately a capture of a few sFlow datagrams in > libpcap format - so that i can analyze them? Let me know. > > Cheers, > Paolo > > > On Fri, Feb 06, 2009 at 06:13:43PM +0100, Axel Apitz wrote: >> Hi All, >> >> i have a problem using aggregate_filter with sfacctd. >> may be i have have understand something wrong ... >> >> I use the following Configuration to collect Inbound traffic >> -- >> debug: true >> daemonize: true >> logfile: /um/var/log/pmacct.log >> networks_file: /um/etc/networks.def >> plugins: print[umShared-inbound] >> print_refresh_time: 5 >> aggregate[umShared-inbound]: dst_net >> aggregate_filter[umShared-inbound]: dst net 94.198.56.0 mask 255.255.255.0 >> -- >> >> But sfacctd show no data. Can i not use aggregate_filter on sflow data ? >> If i remove the aggregate_filter-Config-Line it work ... but i get all >> the crap i am not interested on. >> >> Best Regards, >> Axel Apitz >> >> -- >> Axel Apitz >> >> The unbelievable Machine Company GmbH >> Grolmanstr. 40 >> 10623 Berlin >> Tel.: +49 - 30 - 8892656 - 15 >> Fax.: +49 - 30 - 8892656 - 11 >> Mobile: +49 - 172 - 7300539 >> >> http://www.unbelievable-machine.com > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > -- Axel Apitz The unbelievable Machine Company GmbH Grolmanstr. 40 10623 Berlin Tel.: +49 - 30 - 8892656 - 15 Fax.: +49 - 30 - 8892656 - 11 Mobile: +49 - 172 - 7300539 http://www.unbelievable-machine.com _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
