Home page logo
/

nanog logo nanog mailing list archives

Re: cflowd - seems OK now ;-)
From: ken emery <ken () cnet com>
Date: Fri, 24 Apr 1998 10:28:08 -0700 (PDT)



On Fri, 24 Apr 1998, Leigh Porter wrote:

Hiya folks,

With regards to my earlier problem:

This is an extract of /var/log/messages

Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
928
Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
1168

<SNIP>

And the offending code:


  len = recvfrom(sockfd, (char *)flowpdu, sizeof(*flowpdu),0,
           (struct sockaddr *)&Saddr,&alen);
  if (len < (sizeof(FLOW_PDU_HDR) + (ntohs(flowpdu->header.count) *
                                     sizeof(FLOW_PDU_ENTRY))))
  {
    syslog(LOG_ERR,"[E] %s:%d recvfrom() returned %d",
           __FILE__,__LINE__,len);
    return(-1);
  }
 
Yes, we figured this out too.   Se below for a solution

It was getting the flow data all the time, bit it did not like it.

I am running 11.2.(9)P on which the command:

ip flow-export version 5 origin-as

Does not exist, only the following is there:

ip flow-export dest

Is it a version problem?
 
Yes, it is a version problem.  Cflowd only works with version 5 of 
cisco flows (without code mods).  The approriate config line would 
be:

ip flow-export version 5 ...

Unfortunately it looks like this is only in 11.1(?)

bye,
ken emery



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]