Re: cflowd - seems OK now ;-)

[ken emery <ken () cnet com>]

On Fri, 24 Apr 1998, Leigh Porter wrote:

> Hiya folks,
>
> With regards to my earlier problem:
>
> This is an extract of /var/log/messages
>
> Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
> 928
> Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
> 1168

<SNIP>

> And the offending code:
>
>
>   len = recvfrom(sockfd, (char *)flowpdu, sizeof(*flowpdu),0,
>            (struct sockaddr *)&Saddr,&alen);
>   if (len < (sizeof(FLOW_PDU_HDR) + (ntohs(flowpdu->header.count) *
>                                      sizeof(FLOW_PDU_ENTRY))))
>   {
>     syslog(LOG_ERR,"[E] %s:%d recvfrom() returned %d",
>            __FILE__,__LINE__,len);
>     return(-1);
>   }
 
Yes, we figured this out too.   Se below for a solution

> It was getting the flow data all the time, bit it did not like it.
>
> I am running 11.2.(9)P on which the command:
>
> ip flow-export version 5 origin-as
>
> Does not exist, only the following is there:
>
> ip flow-export dest
>
> Is it a version problem?
 
Yes, it is a version problem.  Cflowd only works with version 5 of 
cisco flows (without code mods).  The approriate config line would 
be:

ip flow-export version 5 ...

Unfortunately it looks like this is only in 11.1(?)

bye,
ken emery