Hi, I run 3 flow-capture daemon which listen on different ports and save netflow files to different directories(/netflow/router1, netflow/router2, netflow/catalyst1 etc.).
I've set up flow-capture with -R, which renames original flow-capture file name to some other name and link to a central directory (/users/flowscan) for flowscan . Now the first period ends and we want to process those files in /users/flowscan. The result we expects should include: - sum and protocol analysis of trafic from all routers, - sum and protocol analysis of trafic from first router, - sum and protocol analysis of trafic from second router ....... etc. We install CUFlow and set up flowscan with central data directory, but when processing those files flowscan reports message like: " ERROR updating /usr/local/flowscan/rrds/router1/ip_address.rrd:illegal attempt to update using time 1082010600 when last update time is 1082076600 (minimum one second step) " and, those rrd files created have no record in it. How could I do with such problems? Can I process those directoies seperately and flowscan will sum up those result automatically? thanks in advance. Regards Joe Shen -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rasmus Hansen Sent: Thursday, April 22, 2004 4:46 PM To: Anukool Lakhina Cc: [EMAIL PROTECTED] Subject: Re: [Flow-tools] 2 questions on flow-export output Anukool Lakhina wrote: > 1) When flow-export reports the *next-hop* IP as 0.0.0.0 and/or the > output interface as 0, what does this mean? Which type of device is the export coming from? I get this from my Junipers, but that is excusable as the documentation (JunOS Feature Guide v6.1 - page 115) states that the next hop IP address is not filled in. > 2) And, what does a flow *destination* IP of 0.0.0.0 imply? Not sure about this one - possibly spoofed traffic? Although I can't think why it would get forwarded unless it's sampling on ingress and then discarding the packet. Again, I'd check the device documentation. Ras _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
