[Cflowd] Flowscan Segmentation fault (Core Dumped) on FreeBSD 4.6

From: Kline, Jonathan (klinej@msoe.edu)
Date: Fri Jan 31 2003 - 11:47:29 PST

  • Next message: Shabbir Husain: "[Cflowd] Require NetFlow Assistance ."

    Howdy All:
            We have a cisco router exporting the flowcontrol stuff as version 5,
    as
    is shown from the following except of a 'show running'

    ip flow-export version 5 peer-as
    ip flow-export destination 155.92.1.8 2055

            On our processing box, cfdcollect, cflowdmux, and clowd are all
    running. The flow files are saved to disk approx. every 4 minutes, and
    appear to be fine, if I do a flowdump on them.

            The errors generated by the flowscan process are as follows,
    NextHops and OutputIfIndexes are undefined.
    Identifying outbound flows based solely on destination address ...
    Loading "/usr/local/var/db/flows/bin/local_nets" ...
    2003/01/31 19:41:03 working on file /var/local/flows/155.92.1.1.flows.0...
    2003/01/31 19:41:03 %CampusIO::FTPSession -> 0
    2003/01/31 19:41:03 %CampusIO::FTPSession -> 0
    /var/local/flows/155.92.1.1.flows.0: Invalid index in cflowd flow file: 0x0!
    Version 5 flow-export is required with *all* fields being saved.
    2003/01/31 19:41:05 flowscan-1.020 CampusIO: Cflow::find took 2 wallclock
    secs ( 2.40 usr + 0.00 sys = 2.40 CPU) for 1000000 flow file bytes, flow
    hit ratio: 11559/11637
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (chunk-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (chunk-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: junk pointer, too high to make sense
    ERROR updating /var/local/graphs/ftpPASV_src.rrd: unknown option
    '/var/local/graphs/ftpPASV_src.rrd'
    perl in free(): warning: modified (page-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (chunk-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (page-) pointer
    ERROR updating /var/local/graphs/ftpPASV_dst.rrd: unknown option
    '/var/local/graphs/ftpPASV_dst.rrd'
    perl in free(): warning: chunk is already free
    perl in free(): warning: modified (page-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (chunk-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (page-) pointer
    perl in free(): warning: chunk is already free
    ERROR updating /var/local/graphs/RealAudio.rrd: unknown option
    '/var/local/graphs/RealAudio.rrd'
    perl in free(): warning: chunk is already free
    2003/01/31 19:41:05 scalar(%CampusIO::RealServer) -> 0
    perl in free(): warning: modified (page-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (chunk-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (page-) pointer
    ERROR updating /var/local/graphs/Quake.rrd: unknown option
    '/var/local/graphs/Quake.rrd'
    perl in free(): warning: chunk is already free
    perl in free(): warning: modified (page-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (chunk-) pointer
    perl in free(): warning: junk pointer, too high to make sense
    perl in free(): warning: modified (page-) pointer
    perl in free(): warning: chunk is already free
    ERROR updating /var/local/graphs/MCAST.rrd: unknown option
    '/var/local/graphs/MCAST.rrd'
    perl in free(): warning: chunk is already free

    I have nearly everything thatc an be commeneted out, commented out in the
    config files for flow scan,
    the only reports generated should be the CampusIO reports, for ip traffic
    only. Napster has been
    excluded form the list.

    The version of flowscan and cflowd and such, is that provided by the FreeBSD
    ports collection.

    All config files and sample flow files are available upon request.

    Anyone have any thoughts, ideas, sugegstions?

    Cheers,

    -- 
    Jonathan Kline <klinej@msoe.edu>
    Milwaukee School of engineering
    

    _______________________________________________ Cflowd mailing list Cflowd@caida.org http://login.caida.org/mailman/listinfo/cflowd



    This archive was generated by hypermail 2.1.4 : Fri Jan 31 2003 - 12:00:50 PST