Anyone have any luck collecting sFlow data from Dell PowerConnect
6248s? We set it up and the data is not being handled correctly in
sfcapd -- constantly generates errors like this:
Jan 12 16:38:19 mindseye sfcapd[13661]: SFLOW: flow_sample_element length error
(expected 94, found 96)
Jan 12 16:38:19 mindseye sfcapd[13661]: SFLOW: caught exception: 3
Any ideas? I've used it fine before with HP Procurves, so I suspect
Dell is doing something wonky. They are already broken in that they
won't generate flows for port channels (undocumented, but support folks
know it by heart).
I grabbed some packets with tshark, looks ok from the outer layer at
least (doesn't disect the samples themselves):
Internet Protocol, Src: 192.168.1.245 (192.168.1.245), Dst: 192.168.1.10
(192.168.1.10)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 638
Identification: 0x3a0d (14861)
Flags: 0x00
0... = Reserved bit: Not set
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xba12 [correct]
[Good: True]
[Bad : False]
Source: 192.168.1.245 (192.168.1.245)
Destination: 192.168.1.10 (192.168.1.10)
User Datagram Protocol, Src Port: sflow (6343), Dst Port: wizard (2001)
Source port: sflow (6343)
Destination port: wizard (2001)
Length: 618
Checksum: 0xce68
[Good Checksum: False]
[Bad Checksum: False]
InMon sFlow
datagram version: 5
agent address: 192.168.1.245 (192.168.1.245)
Sub-agent ID: 0
Sequence number: 2445309
SysUptime: 687203338
NumSamples: 4
sFlow V5 samples (please write and contribute code to dissect them!)
Thanks,
Mark
--
Mark D. Nagel, CCIE #3177 <[email protected]>
Principal Consultant, Willing Minds LLC (http://www.willingminds.com)
cell: 949-279-5817, desk: 714-495-4001, fax: 714-646-8277
** For faster support response time, please
** email [email protected] or call 714-495-4000
------------------------------------------------------------------------------
RSA(R) Conference 2012
Mar 27 - Feb 2
Save $400 by Jan. 27
Register now!
http://p.sf.net/sfu/rsa-sfdev2dev2
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
