Am 27.02.2016 um 13:06 schrieb itria30...@itri.org.tw:
Is there potential risk, such as packet lost to implement a daemon (or modify pmacct) listen to both Netflow and sflow and split them? Libcap is known of packet drop when CPU low (I might be wrong for that community keep improving).
I think there is some misunderstanding.
Only pmacctd process is using libpcap to capture packets and extract traffic information from this packets.
The others (nfacctd and sfacctd) only open network ports and listen for incoming packets. They don't use libpcap.
The traffic information for netflow or sflow is provided by a different system. Typically a router or switch. Also called a Netflow Exporter or sometimes Sensor. That means no raw packets are processed by nfacctd or sfacctd.
Franz _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
