Re: problems with samplicator, anyone able to help?

From: Piret, Benot (Benoit.Piret@bt.be)
Date: Mon Apr 09 2001 - 02:58:14 PDT

  • Next message: Roman Popov: "Re: problems with samplicator, anyone able to help?"

    Hi all,
    I found in the archive the following message which exactly duplicates my
    problem (but , unfortunately for me, I have here the problem, not the answer
    :-(
    I do on the local (10.132.1.154) machine /usr/local/bin/samplicate -S -p
    9992 10.132.1.96/9991/1 10.132.1.154/9991/1
    10.132.1.154 is the local machine
    10.132.1.96 is the cflowd machine.

    It seems that on the cflowd machine, I don't receive the flows anymore
    Do I have to tell cflowd.conf something about 10.132.1.154 ip address ?

    Thanks in advance.

    Benoit
    >>>>> "af" == Andrew Fort <"afort@staff.webcentral.com.au
    <mailto:afort@staff.webcentral.com.au?Subject=Re:%20problems%20with%20sampli
    cator,%20anyone%20able%20to%20help?&In-Reply-To=<aa66nhx4p7.fsf@limmat.switc
    h.ch>> writes:
    > I'm using Samplicator 1.2.1, with the "-S" argument (spoof source
    > address), my cmdline option is:
    > /usr/local/bin/samplicate -S -p 2048 remote.machine/2055/1
    > local.machine/2049/1 &
    > important: "remote.machine" is in a different subnet to
    > "local.machine".
    > local.machine is getting the flows correctly (my cflowdmux listens
    > on port 2049), but my cflowdmux on remote.machine is not (it's
    > listening successfully on port 2055).
    Maybe the packets get dropped by an intermediate router because of the
    spoofed source address. Are the original NetFlow source (router) and
    the samplicator on the same subnet? It could also be another kind of
    packet filter on the router path.
    > Does samplicate work succesfully pushing the data out through a
    > router interface? Anyone had a similar problem?
    I sometimes use the samplicator in spoofing mode through a couple of
    routers and it works ok (although I tend to lose packets from time to
    time when I send them through the whole country :-).
    > I have not yet tested placing "remote.machine" in the same subnet as
    > "local.machine", this will be my next test (after lunch, when I get
    > my hands on this dual 750 machine :)

    -- 
    Simon Leinen				       "simon@babar.switch.ch
    <mailto:simon@babar.switch.ch?Subject=Re:%20problems%20with%20samplicator,%2
    0anyone%20able%20to%20help?&In-Reply-To=<aa66nhx4p7.fsf@limmat.switch.ch>
    SWITCH				   <http://www.switch.ch/misc/leinen/>
    

    Who is General Failure & why's he reading my disk? -- cflowd mailing list "cflowd@caida.org <mailto:cflowd@caida.org?Subject=Re:%20problems%20with%20samplicator,%20anyo ne%20able%20to%20help?&In-Reply-To=<aa66nhx4p7.fsf@limmat.switch.ch>

    --------------------------------- Benoit Piret Network Design Engineer - Data

    BT Belgium Excelsioraan 48-50 B-1930 Zaventem Tel : +32 27183543 Mob : +32496573543 Email:benoit.piret@bt.be

    -- cflowd mailing list cflowd@caida.org



    This archive was generated by hypermail 2b29 : Mon Apr 09 2001 - 03:12:21 PDT