Piotr Looks like a bug. Can you please create a pcap file I an use to reproduce it without the need to install tc? Please file a bug and attach such pcap file on http://www.ntop.org/bugzilla3/
Thanks Luca On 21/apr/2011, at 21:21, Piotr Romanus <[email protected]> wrote: > I wonder if this is a know bug for nprobe 6.1.6. > # nprobe --version > > Welcome to nprobe v.6.1.6 ($Revision: 1835 $) for i686-redhat-linux-gnu > with native PF_RING acceleration. > > > I am generating a single TCP flow using netcat between 2 nodes: > > 30.3.0.10:12345 -> router with nprobe running -> 40.4.0.10:12345 > > NetCat commands used: > client: nc -T lowdelay -v -n -p 12345 -s 30.3.0.10 40.4.0.10 12345 > server: nc -v -l -n 12345 > > > With this single flow nprobe generates 3 NetFlow records! Here is WireShark > output from the node that acts as a collector: > > Frame 24637 (210 bytes on wire, 210 bytes captured) > Ethernet II, Src: Cisco_8b:09:40 (00:16:9c:8b:09:40), Dst: Sony_1c:f4:22 > (00:1d:ba:1c:f4:22) > Internet Protocol, Src: <router IP>, Dst: <my box running WireShark> > User Datagram Protocol, Src Port: iop (2055), Dst Port: iop (2055) > Cisco NetFlow/IPFIX > Version: 5 > Count: 3 > SysUptime: 2035100826 > Timestamp: Apr 21, 2011 14:23:11.000000514 > FlowSequence: 0 > EngineType: 1 > EngineId: 8 > 00.. .... .... .... = SamplingMode: No sampling mode configured (0) > ..00 0000 0000 0001 = SampleRate: 1 > pdu 1/3 > SrcAddr: 30.3.0.10 (30.3.0.10) > DstAddr: 40.4.0.10 (40.4.0.10) > NextHop: 0.0.0.0 (0.0.0.0) > InputInt: 2053 > OutputInt: 0 > Packets: 14 > Octets: 975 > [Duration: 11.988000000 seconds] > StartTime: 2035059.064000000 seconds > EndTime: 2035071.052000000 seconds > SrcPort: 12345 > DstPort: 12345 > padding > TCP Flags: 0x19 > Protocol: 6 > IP ToS: 0x10 > SrcAS: 0 > DstAS: 0 > SrcMask: 0 (prefix: 30.3.0.10/32) > DstMask: 0 (prefix: 40.4.0.10/32) > padding > pdu 2/3 > SrcAddr: 30.3.0.10 (30.3.0.10) > DstAddr: 40.4.0.10 (40.4.0.10) > NextHop: 0.0.0.0 (0.0.0.0) > InputInt: 2053 > OutputInt: 0 > Packets: 1 > Octets: 74 > [Duration: 0.000000000 seconds] > StartTime: 2035059.061000000 seconds > EndTime: 2035059.061000000 seconds > SrcPort: 12345 > DstPort: 12288 > padding > TCP Flags: 0x02 > Protocol: 6 > IP ToS: 0x10 > SrcAS: 0 > DstAS: 0 > SrcMask: 0 (prefix: 30.3.0.10/32) > DstMask: 0 (prefix: 40.4.0.10/32) > padding > pdu 3/3 > SrcAddr: 30.3.0.10 (30.3.0.10) > DstAddr: 40.4.0.10 (40.4.0.10) > NextHop: 0.0.0.0 (0.0.0.0) > InputInt: 2053 > OutputInt: 0 > Packets: 1 > Octets: 72 > [Duration: 0.000000000 seconds] > StartTime: 2035064.907000000 seconds > EndTime: 2035064.907000000 seconds > SrcPort: 12288 > DstPort: 12345 > padding > TCP Flags: 0x18 > Protocol: 6 > IP ToS: 0x10 > SrcAS: 0 > DstAS: 0 > SrcMask: 0 (prefix: 30.3.0.10/32) > DstMask: 0 (prefix: 40.4.0.10/32) > padding > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
