1) When flow-export reports the *next-hop* IP as 0.0.0.0 and/or the
output interface as 0, what does this mean?
Which type of device is the export coming from? I get this from my Junipers, but that is excusable as the documentation (JunOS Feature Guide v6.1 - page 115) states that the next hop IP address is not filled in.
2) And, what does a flow *destination* IP of 0.0.0.0 imply?
Not sure about this one - possibly spoofed traffic? Although I can't think why it would get forwarded unless it's sampling on ingress and then discarding the packet. Again, I'd check the device documentation.
Ras
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
