The manual say the information is extracted from the state table. So you should have seen the info.
First: are you sure the information wasnt in the udp pflow packets ? maybe the collector was wrong. Second: man says <<The packet size and thus the maximum number of flows is controlled by the mtu.>> + On Mon, Sep 9, 2013 at 11:55 AM, Matt Hamilton <[email protected]> wrote: > Hi All, > We use pflow with pf to export packets to a collector for > billing/monitoring > purposes. The problem we have is that someone at the weekend had a very > long running scp connection over several days that transferred a TB > of data. The data was not logged via pflow until the state expired, so > then showed a massive spike when the state expired. > > Anyone know any way around this? Is it possible to get pf/pflow to > export more regularly? Or set some timeout? I'm guessing not due > to the architecture, and unless I force pf states to timeout then I'm > stuck? But thought I'd ask in case anyone knew of a way. > > Thanks > -Matt > > -- --------------------------------------------------------------------------------------------------------------------- () ascii ribbon campaign - against html e-mail /\
