Hi Tony, If the C7600 is the only NetFlow exporter to nfacctd, traffic at the router is counted once (ie. collected ingress-only) and a single nfacctd writing to the 'internet' table you should never get into the situation of overestimated counters. pmacct by itself is not able to duplicate traffic counters; and i've not been repored so far similar behaviours from C7600 with SRC/SRD/SRE codes (also the Cisco bug database appears negative on the matter, but OK ...). The scope is not clear to me: is this behaviour specific to a customer/ port or you reckon it happening throughout your installation? If the latter is the case maybe it's appropriate that i have a look at the issue myself - and if this is possible we switch to unicast for now and summarize over here once the issue is pin-pointed. Your NetFlow export configuration at the router appears OK; also the configuration of pmacct is rather straightforward.
Cheers, Paolo On Thu, Dec 23, 2010 at 03:45:37PM -0800, Tony wrote: > Hi, > > After compiling with 64-bit I am getting larger values, but now I seem to be > getting up to TWICE as much as I should ? Is this a known bug, or something > that I should have changed when I upgraded ? > > The link has continued to be used at 10Mbps, so the usage each hour should > remain around 4.5GB. The numbers between 0200-0400 are probably correct as > there was a slight lull in usage at this time to an average of perhaps > roughly 6Mbps. > > I changed to the 64-bit 0.12.4 version of pmacct at 2330. > > > mysql> select bytes/1000000000 as GB, stamp_inserted, stamp_updated from > internet where agent_id = 1 and stamp_inserted > '2010-12-23 14:00:00' and ip_dst = 'x.y.23.200' order by 3 desc; > +---------+---------------------+---------------------+ > | GB | stamp_inserted | stamp_updated | > +---------+---------------------+---------------------+ > | 10.8867 | 2010-12-24 09:00:00 | 2010-12-24 10:00:01 | > | 9.3094 | 2010-12-24 08:00:00 | 2010-12-24 09:00:01 | > | 11.4398 | 2010-12-24 07:00:00 | 2010-12-24 08:00:01 | > | 8.8432 | 2010-12-24 06:00:00 | 2010-12-24 07:00:01 | > | 4.8371 | 2010-12-24 05:00:00 | 2010-12-24 06:00:01 | > | 4.7354 | 2010-12-24 04:00:00 | 2010-12-24 05:00:01 | > | 3.1966 | 2010-12-24 03:00:00 | 2010-12-24 04:00:01 | > | 2.2933 | 2010-12-24 02:00:00 | 2010-12-24 03:00:01 | > | 4.8357 | 2010-12-24 01:00:00 | 2010-12-24 02:00:01 | > | 6.9992 | 2010-12-24 00:00:00 | 2010-12-24 01:00:01 | > | 0.2545 | 2010-12-23 23:00:00 | 2010-12-24 00:00:01 | > | 0.5420 | 2010-12-23 22:00:00 | 2010-12-23 23:00:01 | > | 0.5429 | 2010-12-23 21:00:00 | 2010-12-23 22:00:01 | > | 0.7547 | 2010-12-23 20:00:00 | 2010-12-23 21:00:01 | > | 2.9795 | 2010-12-23 19:00:00 | 2010-12-23 20:00:01 | > | 2.3076 | 2010-12-23 18:00:00 | 2010-12-23 19:00:01 | > | 0.1109 | 2010-12-23 17:00:00 | 2010-12-23 18:00:01 | > | 0.2496 | 2010-12-23 16:00:00 | 2010-12-23 17:00:01 | > | 0.1036 | 2010-12-23 15:00:00 | 2010-12-23 16:00:01 | > +---------+---------------------+---------------------+ > 19 rows in set (0.00 sec) > > > Any ideas ? > > > Thanks, > Tony. _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
