On 03/14/2009 09:59:30 AM, Chris Wilson wrote: > Hi Paolo, > > I'm running pmacctd 0.11.5 on a small network for traffic accounting. > Generally it's behaving well, but occasionally I can see weird data > being > inserted:
> The byte counters look bogus to me. It's hard to imagine how anyone > could > send 4 GB of data down through my cable modem connection in just one > minute. > Do you have any ideas what might be going on here? Have you bound to an interface with 'interface'? Could be you're picking up, say, a file transfer to your gateway. You'd want to monitor your external interface, or filter out traffic to the box itself. Just a thought. As a debugging aid (or in general) you might consider putting your rfc1918 network in a networks file. With an aggregate on sum_net and without any other filters you get the cross product of all the possibilities so can see if there's traffic from/to the local network or other things you're perhaps not expecting. If nothing else a quick test with the memory plugin may be revealing. Regards, Karl <[email protected]> Free Software: "You don't pay back, you pay forward." -- Robert A. Heinlein _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
