Hi all,
I'm new to pmacct, hope someone can shed some light on the symptom that
I'm seeing.
I'm exporting L2 netflow with the following template, however from the
nfacctd debug log, some of entries are interpreted as "58" and "256".
Is there something that I will need to tweak?
/chunsing
===================
hostname# show flow record netflow layer2-switched input
Flow record netflow layer2-switched input:
Description: layer2-switched input NetFlow
No. of users: 1
Template ID: 262
Fields:
match interface input
match interface output
match datalink mac source-address
match datalink mac destination-address
match datalink source-vlan-id
match datalink ethertype
match flow direction
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
====================
INFO ( default/core ): waiting for NetFlow data on :::9995
DEBUG ( default/core ): Discarded NetFlow v9/IPFIX packet (R: unknown
template 262 [::ffff:10.1.10.20:256])
DEBUG ( default/core ): NfV9 agent : ::ffff:<my_ip_addr>:256
DEBUG ( default/core ): NfV9 template type : flow
DEBUG ( default/core ): NfV9 template ID : 260
DEBUG ( default/core ): ----------------------------------------
DEBUG ( default/core ): | field type | offset | size |
DEBUG ( default/core ): | input snmp | 0 | 4 |
DEBUG ( default/core ): | output snmp | 4 | 4 |
DEBUG ( default/core ): | direction | 8 | 1 |
DEBUG ( default/core ): | 256 | 9 | 2 |
DEBUG ( default/core ): | in bytes | 11 | 4 |
DEBUG ( default/core ): ----------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 15
DEBUG ( default/core ):
DEBUG ( default/core ): NfV9 agent : ::ffff:<my_ip_addr> :256
DEBUG ( default/core ): NfV9 template type : flow
DEBUG ( default/core ): NfV9 template ID : 262
DEBUG ( default/core ): ----------------------------------------
DEBUG ( default/core ): | field type | offset | size |
DEBUG ( default/core ): | input snmp | 0 | 4 |
DEBUG ( default/core ): | output snmp | 4 | 4 |
DEBUG ( default/core ): | in src mac | 8 | 6 |
DEBUG ( default/core ): | out dst mac | 14 | 6 |
DEBUG ( default/core ): | 58 | 20 | 2 |
DEBUG ( default/core ): | direction | 22 | 1 |
DEBUG ( default/core ): |256 | 23 | 2 |
DEBUG ( default/core ): | in bytes | 25 | 4 |
DEBUG ( default/core ): | in packets | 29 | 4 |
DEBUG ( default/core ): | last switched | 37 | 4 |
DEBUG ( default/core ): ----------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 41
DEBUG ( default/core ):
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
