Hi Yang,
Apparently you are exporting flows to [127.0.0.1]:6343 but you are listening with tcpdump on interface 'eno1'? Paolo On Sun, Jun 23, 2019 at 12:53:59AM -0700, Yang Yu wrote: > I tried to use pmacct to sample local interface and create sFlow > exports. From debug it looks like packets are being sampled but no > sFlow export was ever received. I tried sampling rate 1 or 100, still > no exports. What am I missing? > > > Yang > > > > > cat pmacctd_sflow.conf > plugins: sfprobe > sampling_rate:1 > pcap_interface: eno1 > > > > > $ sudo pmacctd -f pmacctd_sflow.conf -d > DEBUG: [pmacctd_sflow.conf] plugin name/type: 'default'/'core'. > DEBUG: [pmacctd_sflow.conf] plugin name/type: 'default_sfprobe'/'sfprobe'. > DEBUG: [pmacctd_sflow.conf] sampling_rate:100 > DEBUG: [pmacctd_sflow.conf] pcap_interface:eno1 > DEBUG: [pmacctd_sflow.conf] debug:true > INFO ( default/core ): Promiscuous Mode Accounting Daemon, pmacctd > 1.7.3-git (20190418-00+c4) > INFO ( default/core ): '--enable-jansson' '--enable-mysql' > '--enable-pgsql' '--enable-sqlite3' '--enable-ndpi' > 'PKG_CONFIG_PATH=/usr/local/libdata/pkgconfig' '--enable-l2' > '--enable-64bit' '--enable-traffic-bins' '--enable-bgp-bins' > '--enable-bmp-bins' '--enable-st-bins' > INFO ( default/core ): Reading configuration file > '/home/user/tmp/pmacct/pmacctd_sflow.conf'. > INFO ( default_sfprobe/sfprobe ): plugin_pipe_size=4096000 bytes > plugin_buffer_size=424 bytes > INFO ( default_sfprobe/sfprobe ): ctrl channel: obtained=212992 bytes > target=77280 bytes > DEBUG ( default_sfprobe/sfprobe ): Creating sFlow agent. > INFO ( default_sfprobe/sfprobe ): Exporting flows to [127.0.0.1]:6343 > INFO ( default_sfprobe/sfprobe ): Sampling at: 1/100 > INFO ( default/core ): [eno1,0] link type is: 1 > DEBUG ( default_sfprobe/sfprobe ): 74d435e8fa15 -> 384f49cda533 (len = > 549, captured = 128) > DEBUG ( default_sfprobe/sfprobe ): 384f49cda533 -> 74d435e8fa15 (len = > 1514, captured = 128) > DEBUG ( default_sfprobe/sfprobe ): 384f49cda533 -> 74d435e8fa15 (len = > 2942, captured = 128) > DEBUG ( default_sfprobe/sfprobe ): 74d435e8fa15 -> 384f49cda533 (len = > 86, captured = 86) > DEBUG ( default_sfprobe/sfprobe ): 74d435e8fa15 -> 384f49cda533 (len = > 86, captured = 86) > > > > $ sudo tcpdump port 6463 -vvvv > tcpdump: listening on eno1, link-type EN10MB (Ethernet), capture size > 262144 bytes > ^C > 0 packets captured > 0 packets received by filter > 0 packets dropped by kernel > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
