Skip to content

Commit 2149083

Browse files
committed
Update README regarding promisc and sampling.
1 parent 12b9c98 commit 2149083

File tree

2 files changed

+16
-3
lines changed

2 files changed

+16
-3
lines changed

README

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -389,9 +389,11 @@ ipt_NETFLOW linux 2.6.x-3.x kernel module by <abc@telekom.ru> -- 2008-2014.
389389
sampler=deterministic:123
390390
sampler=random:123
391391
sampler=hash:123
392-
- enables Flow Sampling. To disable set to the empty value. Note, that
393-
this is flow sampling (as of RFC 7014), not packet sampling (PSAMP).
394-
There is two standard sampling modes:
392+
- enables Flow Sampling. To disable set to the empty value or to `0'.
393+
Note, that this is flow sampling (as of RFC 7014), not packet
394+
sampling (PSAMP).
395+
396+
There is three sampling modes:
395397

396398
deterministic: select each N-th observed flow; in IPFIX this mode
397399
is called Systematic count-based Sampling;
@@ -523,6 +525,9 @@ ipt_NETFLOW linux 2.6.x-3.x kernel module by <abc@telekom.ru> -- 2008-2014.
523525
to reduce load on exporting CPU by increasing this interval. Value are
524526
in kernel jiffies units (which is x/HZ seconds).
525527

528+
promisc = 1
529+
- Enable promisc hack. See README.promisc Solution.1 for details.
530+
526531

527532
====================
528533
= HOW TO READ STAT =

README.promisc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ If you wish to account with ipt-netflow module traffic mirrored on switch you ma
3838
let iptables to see promisc traffic. That traffic will not be routed anywhere
3939
and discarded just after passing PREROUTING chain.
4040

41+
Do not enable this option if you have kernel already patched with promisc
42+
patch, as this may cause double accounting. Just keep it disabled or remove
43+
the patch. Promisc patching is completely custom and non-standard, so if you
44+
did not apply it - you are most probably safe to use promisc option. But, if
45+
in doubt - measure if module seeing traffic in raw/PREROUTING, if it isn't - you
46+
don't have the patch applied and certainly safe to use the option.
47+
4148

4249

4350
**************
@@ -88,6 +95,7 @@ Voila.
8895
ps. For Debian Squeeze instructions look at raw_promisc_debian_squeeze6.patch
8996

9097

98+
9199
**************
92100
* Solution 3 *
93101
**************

0 commit comments

Comments
 (0)