-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
Onur BEKTAS wrote:
>
> Hi,
>
> We installed latest nfdump (snapshot 1.5.7-20081221) but
> netflow data couldnt stored correctly by nfcapd. When nfdump
> reads nfcapd files its gives error:
>
> 'Corrupt data file. Extension map id 337 too big'
>
> and also nfdump cannot read old nfcapd files and gives error:
>
> 'Can't process block type 1. Skip block'
>
> We are using FreeBSD 7.0 AMD 64 release.
Hmm .. not sure if the snapshot is already fully 64bit clean. Obviously not. I
need to verify and correct that.
- Peter
>
> Regards,
>
> Onur.
>
>
> Peter Haag wrote:
>> Hi,
>
>> Onur BEKTAS wrote:
>>> Hi all,
>>> Our huawei router seems a little bit creative while dealing with
>>> interface numbers, below is the snmpwalk snapshot :
>>> IF-MIB::ifDescr.67109633 = STRING: GigabitEthernet1/0/3
>>> IF-MIB::ifDescr.67109761 = STRING: GigabitEthernet1/0/4
>>> Interface description numbers are far above the max nfsen limit
>>> which is 65535. If we write a filter with such a large interface
>>> number nfsen gives an error:
>>> ERROR: Filter error: line 1: Input interface number must be
>> 0..65535 at
>>> '16789145'!
>>> Is there any way to fix this?
>> Not for any stable version. There is a patch, which makes nfdump
>> accepting 32bit interface numbers, but strips it down to 16bits for
>> compatible storage. You may use the latest nfdump snapshot
>> 1.5.7-20081221, which implements clean 32bit interfaces number. But
>> this is development quality software.
>
>> - Peter
>
>>> Thanks
>
>>> Onur BEKTAS Sistem Yöneticisi / System Administrator TÜB0TAK
>>> ULAKB0M
>
>
>
>
>
>> ------------------------------------------------------------------------------
>
>>> This SF.net email is sponsored by: SourcForge Community
>>> SourceForge wants to tell your story.
>>> http://p.sf.net/sfu/sf-spreadtheword
>>> _______________________________________________ Nfsen-discuss
>>> mailing list [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- ------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [email protected] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBSXQfDP5AbZRALNr/AQIfkgQAjHhfXzidyPTU0U27pU1s0nGvhiNwQapE
o+B4hnBxm+Iq5QhaI3L+ao/WiVmO9O5/+biR/sANHEh2kuQbvvV5XbF6lr29syl9
pOq1CZhA21qGhAFwwJ5lscCvNH5iVzVCQP/1aHfsvOLtoHQk4MErNdrK3YpN0Oij
6x6To/urPiw=
=tDEs
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
