sfacctd is using the UDP packet source address rather than the agent-id within the packet to identify the originator of the sflow packet. If you aggregate sflow packets from several switches through a single forwarder (eg with sflowtool -f ) you get a lot of warnings sent to syslog as the serial numbers seem not to be in order (as they are coming from different switches). Reproducible: Always Steps to Reproduce: 1. See description 2. Look in log file Actual Results: logs of warnings in log file Expected Results: no warnings in log file This bug has been fixed in the pmacct CVS tree but not released as a new version. I have extracted the patch and created a new ebuild that applies the patch. This solves the problem I am seeing.
Created attachment 107378 [details, diff] patch to fix problem taken from pmacct CVS tree This patch is likely already be applied in the next version of pmacct
0.11.3 already in CVS (committed by vanquirius)
