Re: [Nfdump-discuss] Error netflow header

[Peter H. <ha...@sw...>]

-----BEGIN PGP SIGNED MESSAGE-----

Hi Chelo,


- --On February 28, 2006 11:48:54 +0100 Chelo Malagon <che...@re...> wrote:

| Hello,
| I get this error when try to collect flows from Juniper routers:
| Feb 24 13:35:04 rivendel /usr/local/bin/nfcapd[2233]: Error netflow header: Unexpected netflow version 1, found.

nfcapd does not support netflow v1 records.

|
| NOC people here assure routers are exporting in v5 format, but it
| seems they dont. Has anybody got the same error?

obviously - there are some v1 records. I can check that, if you could send
me tcpdump captured flows to look into. Otherwise it's a bit difficult.
I know from other people using junipers and nfdump successully.

|
| In the other hand, i was wondering in nfcapd has any option to configure
| compression level as flow-capture has (-z option).

No - it doesn't. It would burn your CPU at that speed it can collect flows.
If you still want to compress automatically, use the -x commands:

nfcapd .... -x /usr/bin/gzip %d/%f

this will call gzip at the end of each cycle and compress the file.

... but still - have a lock at your CPU. :)

    - Peter

|
| Peter thanks for the link to samplicator software. It does what I want
| to do: resend the packets to a different port based on the source address
| of the packet.
|
| Cheers,
| Chelo
|
|
|
|
| -------------------------------------------------------
| This SF.Net email is sponsored by xPML, a groundbreaking scripting language
| that extends applications into web and mobile media. Attend the live webcast
| and join the prime developer group breaking into this new coding territory!
| http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
| _______________________________________________
| Nfdump-discuss mailing list
| Nfd...@li...
| https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
|



- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iQCVAwUBRAVW0/5AbZRALNr/AQFiYgQAibkp7GvhhmWZVigiG7/dqI8iMRP+2BBm
MBIhLp4pDovgNWmHuY82UB1AGKRNRVPSol5dMdfniOGdzpX0mBQGzSKmfG6ZioET
kpADML69qV3318Gg5+i1gKEjm692Xcc860aruA348mMHC17X9H3g3aerAxJbkpY9
NgNOo5cyj2A=
=Id/q
-----END PGP SIGNATURE-----