Hello Peter,

Thanks for the tip - you are right - the AS field has 4 bytes. I didn't notice it from the capture until you pointed it out. :)
I will look into upgrading :)

Thanks again,
Adrian

On Tue, Jun 29, 2010 at 5:09 PM, Peter Haag <peter.haag@switch.ch> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Adrian,


> What can I do to further troubleshoot this issue? I kind of remember I could
> start the collector in some sort of debug mode, but I don't remember the
> specifics...
> I am running nfsen 1.3 and nfdump 1.5.7 (rather old, I know, but they served
> me well).

I pleased to hear that :) but I hope that also nfdump-1.6.1 will serve you well.
nfdump-1.5.7 collects only 16bit AS numbers and skips 32bit ASes, setting them to 0.
Your IOS-XR most likely sends 4byte ASes on v9.

       - Peter

>
> Looking forward for suggestions,
> Thanks,
> Adrian
>
>
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
>
>
>
> _______________________________________________
> Nfsen-discuss mailing list
> Nfsen-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box,  CH-8021   Zurich, Switzerland
E-mail: peter.haag@switch.ch Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQCVAwUBTCn+e/5AbZRALNr/AQL8jgQAhb+B0HWy4ScqvEXRMtAtPjF5d4PmTElK
lsRIEUmwkI8WkOngLHGp6wWGBBB9LJcUU9zlJRoUYsf/mtMWxLN83WR/F+AeWBHX
iYTrq3k7M3sA0gtCiwVbhchEng78DoRzywOigz0qxghF26+1HayclNJgRqQiGi8Q
NmciIz8fKfo=
=KRkD
-----END PGP SIGNATURE-----