Re: pflow packets before state expires

2013-09-17 Thread Henning Brauer
* Matt Hamilton [2013-09-10 12:30]: > sven falempin gmail.com> writes: [nonsense deleted] > The problem is that (I believe) that the pflow packet is not generated until > the state expires from pf. In the case of the scp transfer I saw that was not > for several days. Meaning I had no accounting

Re: pflow packets before state expires

2013-09-10 Thread Matt Hamilton
sven falempin gmail.com> writes: > > The manual say the information is extracted from the state table. > So you should have seen the info. > > First: are you sure the information wasnt in the udp pflow packets ? maybe > the collector was wrong. > Second: man says < controlled by the mtu.>> The

Re: pflow packets before state expires

2013-09-09 Thread sven falempin
The manual say the information is extracted from the state table. So you should have seen the info. First: are you sure the information wasnt in the udp pflow packets ? maybe the collector was wrong. Second: man says <> + On Mon, Sep 9, 2013 at 11:55 AM, Matt Hamilton wrote: > Hi All, > We

pflow packets before state expires

2013-09-09 Thread Matt Hamilton
Hi All, We use pflow with pf to export packets to a collector for billing/monitoring purposes. The problem we have is that someone at the weekend had a very long running scp connection over several days that transferred a TB of data. The data was not logged via pflow until the state expired, so