Hi David, On Tue, May 05, 2009 at 11:34:08PM +1000, David Hill [eStation] wrote:
> # tcpdump -ne -i any > tcpdump: any: No such device exists > (SIOCGIFHWADDR: No such device) You might try to download a source tarball of tcpdump and link it against the same libpcap which is making the 'any' interface work with pmacct. > We were using a different software package (netacct-mysql) to perfom the > same function and it could be bound to multiple devices (eg. eth0.10, > eth0.11, etc) - Is there a relatively easy way to accomplish this with > pmacctd? Running multiple pmacctd daemons on the same box, binding each to the interface of interest. As you are writing to a centralized DB anyway, it shouldn't complicate your life too much. Perhaps a bit of overhead on one side; but definitely something more supported than the 'any' interface on the other - IHMO. > Both boxes have IP addresses in all subnets in both upstream and downstream > VLANs. This should, as far as my understanding indicates, ensure that any > traffic flows aren't counted any more than twice - once on the incoming > interface and once of the outgoing interface. > > If this isn't the case, surely this would not result in such a massive > discrepancy between the real and accounted traffic flows? Again, please > correct me if I'm wrong. Unfortunately it can be hard to say without either a diagram of the network, both physical (what connects where) and logical (VLANs, IP addressing and subnetting, BGP sessions, VRRP setup), or a tcpdump trace with some test traffic. Do you have handy some examples? Packet and byte counters: both real and the ones inflated by pmacct. Can you recognize any pattern (ie. traffic between specific customers or inbound only or outgoing only, etc.) or is it everything inflated? Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
