From: Kline, Jonathan (klinej@msoe.edu)
Date: Fri Jan 31 2003 - 11:47:29 PST
Howdy All:
We have a cisco router exporting the flowcontrol stuff as version 5,
as
is shown from the following except of a 'show running'
ip flow-export version 5 peer-as
ip flow-export destination 155.92.1.8 2055
On our processing box, cfdcollect, cflowdmux, and clowd are all
running. The flow files are saved to disk approx. every 4 minutes, and
appear to be fine, if I do a flowdump on them.
The errors generated by the flowscan process are as follows,
NextHops and OutputIfIndexes are undefined.
Identifying outbound flows based solely on destination address ...
Loading "/usr/local/var/db/flows/bin/local_nets" ...
2003/01/31 19:41:03 working on file /var/local/flows/155.92.1.1.flows.0...
2003/01/31 19:41:03 %CampusIO::FTPSession -> 0
2003/01/31 19:41:03 %CampusIO::FTPSession -> 0
/var/local/flows/155.92.1.1.flows.0: Invalid index in cflowd flow file: 0x0!
Version 5 flow-export is required with *all* fields being saved.
2003/01/31 19:41:05 flowscan-1.020 CampusIO: Cflow::find took 2 wallclock
secs ( 2.40 usr + 0.00 sys = 2.40 CPU) for 1000000 flow file bytes, flow
hit ratio: 11559/11637
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (chunk-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (chunk-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: junk pointer, too high to make sense
ERROR updating /var/local/graphs/ftpPASV_src.rrd: unknown option
'/var/local/graphs/ftpPASV_src.rrd'
perl in free(): warning: modified (page-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (chunk-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (page-) pointer
ERROR updating /var/local/graphs/ftpPASV_dst.rrd: unknown option
'/var/local/graphs/ftpPASV_dst.rrd'
perl in free(): warning: chunk is already free
perl in free(): warning: modified (page-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (chunk-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (page-) pointer
perl in free(): warning: chunk is already free
ERROR updating /var/local/graphs/RealAudio.rrd: unknown option
'/var/local/graphs/RealAudio.rrd'
perl in free(): warning: chunk is already free
2003/01/31 19:41:05 scalar(%CampusIO::RealServer) -> 0
perl in free(): warning: modified (page-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (chunk-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (page-) pointer
ERROR updating /var/local/graphs/Quake.rrd: unknown option
'/var/local/graphs/Quake.rrd'
perl in free(): warning: chunk is already free
perl in free(): warning: modified (page-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (chunk-) pointer
perl in free(): warning: junk pointer, too high to make sense
perl in free(): warning: modified (page-) pointer
perl in free(): warning: chunk is already free
ERROR updating /var/local/graphs/MCAST.rrd: unknown option
'/var/local/graphs/MCAST.rrd'
perl in free(): warning: chunk is already free
I have nearly everything thatc an be commeneted out, commented out in the
config files for flow scan,
the only reports generated should be the CampusIO reports, for ip traffic
only. Napster has been
excluded form the list.
The version of flowscan and cflowd and such, is that provided by the FreeBSD
ports collection.
All config files and sample flow files are available upon request.
Anyone have any thoughts, ideas, sugegstions?
Cheers,
-- Jonathan Kline <klinej@msoe.edu> Milwaukee School of engineering_______________________________________________ Cflowd mailing list Cflowd@caida.org http://login.caida.org/mailman/listinfo/cflowd
This archive was generated by hypermail 2.1.4 : Fri Jan 31 2003 - 12:00:50 PST