Hi Martin,
On Mon, Jan 13, 2014 at 02:45:25PM +0100, Martin Topholm wrote:
> On Fri, 10 Jan 2014, Paolo Lucente wrote:
>
> [ .. ]
>
> > Any chance the traffic is VLAN-tagged and/or MPLS-labelled and
> > VLAN tag and/or MPLS labels are exposed to pmacct via IPFIX? In
> > such a case you should reflect this in the filter, ie. 'vlan
> > and ...', 'mpls and ...' or 'vlan and mpls and ...'.
>
> This appears to be the case. If all rules are duplicated with
> "vlan or (...)" everyting seems to work, only expected non-classified
> traffic remains with tag 901 and 902.
>
> How come the vlan expression is needed?
Great to know. libpcap is leveraged for filtering purposes ('filter'
keyword in pre_tag_map and 'aggregate_filter') and this is a known
limitation (perhaps the most annoying) of libpcap-based filters. It's
some time i'm thinking would be good to find viable (ie. also more
efficient) alternatives to that.
Cheers,
Paolo
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
