File tree Expand file tree Collapse file tree 2 files changed +16
-3
lines changed Expand file tree Collapse file tree 2 files changed +16
-3
lines changed Original file line number Diff line number Diff line change @@ -389,9 +389,11 @@ ipt_NETFLOW linux 2.6.x-3.x kernel module by <abc@telekom.ru> -- 2008-2014.
389389 sampler=deterministic:123
390390 sampler=random:123
391391 sampler=hash:123
392- - enables Flow Sampling. To disable set to the empty value. Note, that
393- this is flow sampling (as of RFC 7014), not packet sampling (PSAMP).
394- There is two standard sampling modes:
392+ - enables Flow Sampling. To disable set to the empty value or to `0'.
393+ Note, that this is flow sampling (as of RFC 7014), not packet
394+ sampling (PSAMP).
395+
396+ There is three sampling modes:
395397
396398 deterministic: select each N-th observed flow; in IPFIX this mode
397399 is called Systematic count-based Sampling;
@@ -523,6 +525,9 @@ ipt_NETFLOW linux 2.6.x-3.x kernel module by <abc@telekom.ru> -- 2008-2014.
523525 to reduce load on exporting CPU by increasing this interval. Value are
524526 in kernel jiffies units (which is x/HZ seconds).
525527
528+ promisc = 1
529+ - Enable promisc hack. See README.promisc Solution.1 for details.
530+
526531
527532====================
528533= HOW TO READ STAT =
Original file line number Diff line number Diff line change @@ -38,6 +38,13 @@ If you wish to account with ipt-netflow module traffic mirrored on switch you ma
3838 let iptables to see promisc traffic. That traffic will not be routed anywhere
3939 and discarded just after passing PREROUTING chain.
4040
41+ Do not enable this option if you have kernel already patched with promisc
42+ patch, as this may cause double accounting. Just keep it disabled or remove
43+ the patch. Promisc patching is completely custom and non-standard, so if you
44+ did not apply it - you are most probably safe to use promisc option. But, if
45+ in doubt - measure if module seeing traffic in raw/PREROUTING, if it isn't - you
46+ don't have the patch applied and certainly safe to use the option.
47+
4148
4249
4350 **************
8895ps. For Debian Squeeze instructions look at raw_promisc_debian_squeeze6.patch
8996
9097
98+
9199 **************
92100 * Solution 3 *
93101 **************
You can’t perform that action at this time.
0 commit comments