Hi Michael, I would suggest to comment out buffering, especially if the volume of NetFlow packets is not sustained (plugin_pipe_size, plugin_buffer_size); that should return a more accurate comparison. Should differences still persist, the course of action would be a unicast email to me with the following info: 1) values reported by nfcapd; 2) a capture in libpcap format of the NetFlow exported by your routers (so to reproduce things in lab); 3) a sample of the output returned by nfacctd.
Paolo On Sat, Jun 17, 2017 at 08:06:29PM +0200, Michael wrote: > Hi, > > I am exporting Netflow from 2 Mikrotik CCR (v9 but I also tried version 5) > and trying to capture them with nfacctd. > My config for testing: > plugins: print > !debug: true > print_refresh_time: 300 > print_output: json > print_output_file: /tmp/nfacctd > nfacctd_port: 2056 > nfacctd_renormalize: true > nfacctd_disable_checks: true > plugin_pipe_size: 102400000 > plugin_buffer_size: 10240 > aggregate: dst_host > > > The data nfacctd provided looked wrong and therefore i captured the exact > same netflows (on 2 different ports) with nfacctd and nfcapd which shows > these results: > nfacctd (nfacctd 1.6.2-git) for test address: "packets": 698015, "bytes": > 561208397 > nfcapd (Version: 1.6.12) for test address: packets: 879505 bytes: 704001361 > > nfcapd commandline: nfcapd -p 2055 -l /tmp -t 300 > > I am not sure why there is such a big difference, maybe someone can point me > the right direction? > > Kind Regards, > Michael > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
