Home page logo
/

nanog logo nanog mailing list archives

cflowd - seems OK now ;-)
From: Leigh Porter <leigh () wisper net>
Date: Fri, 24 Apr 1998 17:52:44 +0000

Hiya folks,

With regards to my earlier problem:

This is an extract of /var/log/messages

Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
928
Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168
Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168
Apr 24 18:44:53 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
400
Apr 24 18:44:53 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168
Apr 24 18:44:54 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
208
Apr 24 18:44:54 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168
Apr 24 18:44:54 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168
Apr 24 18:44:56 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
400
Apr 24 18:44:56 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168
Apr 24 18:44:56 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168
Apr 24 18:44:57 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
208

And the offending code:


  len = recvfrom(sockfd, (char *)flowpdu, sizeof(*flowpdu),0,
           (struct sockaddr *)&Saddr,&alen);
  if (len < (sizeof(FLOW_PDU_HDR) + (ntohs(flowpdu->header.count) *
                                     sizeof(FLOW_PDU_ENTRY))))
  {
    syslog(LOG_ERR,"[E] %s:%d recvfrom() returned %d",
           __FILE__,__LINE__,len);
    return(-1);
  }


It was getting the flow data all the time, bit it did not like it.

I am running 11.2.(9)P on which the command:

ip flow-export version 5 origin-as

Does not exist, only the following is there:

ip flow-export dest

Is it a version problem?

Anyway, I commented out the above code and it's collecting stats, I get
a lot of:

Apr 24 18:58:32 mekong cflowd[16687]: [E] cflowd.c:364 missed
2.12341e+07 flows from 193.164.160.114
Apr 24 18:58:32 mekong cflowd[16687]: [E] cflowd.c:364 missed
2.91787e+07 flows from 193.164.160.114
Apr 24 18:58:32 mekong cflowd[16687]: [E] cflowd.c:364 missed
2.07987e+09 flows from 193.164.160.114

But it's collecting something...!


--
Leigh Porter




  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]