More precisely, the masks are:
this is for netflow v5
#define FT_XFIELD_V5_MASK 0x000000000FFF37EFLL
which includes the exporter address field:
#define FT_XFIELD_EXADDR 0x0000000000000008LL
Just in case this helps somebody:
use flow-export in ASCII mode and specify -m 0xffffffff as starting point.
Ulisses
On Tue, Mar 07, 2006 at 09:01:34AM +0100, ulisses wrote:
> Hello
>
> reading the source code (lib/ftlib.h) I seems to me that the exporter is
> saved when capturing from multiple flows. I refer to the following
> extructure:
>
> struct fts3rec_v5_gen {
> u_int32 unix_secs; /* Current seconds since 0000 UTC 1970 */
> u_int32 unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
> u_int32 sysUpTime; /* Current time in millisecs since router booted */
> u_int32 exaddr; /* Exporter IP address */
> u_int32 srcaddr; /* Source IP Address */
> u_int32 dstaddr; /* Destination IP Address */
> u_int32 nexthop; /* Next hop router's IP Address */
> u_int16 input; /* Input interface index */
> u_int16 output; /* Output interface index */
> u_int32 dPkts; /* Packets sent in Duration */
> u_int32 dOctets; /* Octets sent in Duration. */
> u_int32 First; /* SysUptime at start of flow */
> u_int32 Last; /* and of last packet of flow */
> u_int16 srcport; /* TCP/UDP source port number or equivalent */
> u_int16 dstport; /* TCP/UDP destination port number or equiv */
> u_int8 prot; /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
> u_int8 tos; /* IP Type-of-Service */
> u_int8 tcp_flags; /* OR of TCP header bits */
> u_int8 pad;
> u_int8 engine_type; /* Type of flow switching engine (RP,VIP,etc.) */
> u_int8 engine_id; /* Slot number of the flow switching engine */
> u_int8 src_mask; /* mask length of source address */
> u_int8 dst_mask; /* mask length of destination address */
> u_int16 src_as; /* AS of source address */
> u_int16 dst_as; /* AS of destination address */
> };
>
>
> am I right? If so, how I can print the exporter of a netflow v5 format when
> using flow-print?
>
> Thanks
>
> Ulisses
>
>
>
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
