# flow capture and softflowd on the same machine



## fluca1978 (Nov 26, 2012)

I've got a 9.0-RELEASE with two network adapters _em0, em1_. I want to test flow capture on the machine for all the traffic generated on the _em1_ interface (statically bound to _192.168.200.2_), that is one used for instance for SSH-ing the machine.
In my rc.conf I've got the following:


```
flow_capture_enable="YES"                                                               
flow_capture_datadir="/netflows"                                                        
flow_capture_remoteid="192.168.200.2"                                                   
flow_capture_flags="-n 287 -S 5 "    

softflowd_enable="YES"                                                                  
softflowd_interfaces="em1"                                                              
softflowd_em1_collector="localhost:8787"
```

I can see both the processes running, traffic on the interface is done, but no file is generated on the local machine even when sending an _HUP_ signal.
I cannot see what is wrong with my configuration, any help?


----------



## fluca1978 (Nov 27, 2012)

I've tried to enable the flow capturing on both interfaces to see if the _em1_ was having some problem:


```
flow_capture_enable="YES"                                                               
flow_capture_datadir="/netflows"                                                        
flow_capture_remoteid="192.168.200.2"                                                   
flow_capture_flags="-n 287 -S 5 "    

softflowd_enable="YES"                                                                  
softflowd_interfaces="em0 em1"
softflowd_em0_collector="localhost:8787"
softflowd_em1_collector="localhost:8787"
```

This is what processes are running (of course, I restarted the services), but even sending a SIGHUP to flow-capture does not make any file appearing under /netflows:


```
# ps -afx | grep flow                      
 3443  ??  Is     0:00.01 /usr/local/sbin/softflowd -i em0 -n localhost:8787 -m 16000 -p  
 3451  ??  Is     0:00.01 /usr/local/sbin/softflowd -i em1 -n localhost:8787 -m 16000 -p  
 3475  ??  Ss     0:00.02 /usr/local/bin/flow-capture -n 287 -S 5 -w /netflows -p /var/ru
```


Even making _flow-capture_ to listen from any remote host does not produce any result.


----------

