Netgraph and Netflow-v9

[Kolasinski, Brent D.]

It appears that it may be something with my current collector.  While
debugging today, I decided to attempt to run Silk locally on the FreeBSD
netflow box.  

When exporting locally, it is reading the netflow-v9 records.  Yay!

Our collector is an older Linux box with a manually compiled current
version of Silk (not that it should matter which OS is running on the
collector) with the libfixbuf patch installed.  I wonder what is going on
there, alas, that is not your problem :)

Thanks for the help!

----------
Brent Kolasinski
Cyber Security Program Office
Argonne National Laboratory
Phone: 630-252-2546




On 6/11/12 5:16 PM, "Kolasinski, Brent D." <bkolasinski at anl.gov> wrote:

>
>On 6/11/12 12:36 PM, "Alexander V. Chernikov" <melifaro at FreeBSD.org>
>wrote:
>>
>>It seems so.
>>
>>Can you show "ngctl msg netflow: info" ouput ?
>
>Rec'd response "info" (805306369) from "[16]:":
>Args:	{ IPv4 bytes=4828162266587 IPv4 packets=1005674835 IPv4 records
>used=61793 fibs allocated=1 Active expiries=26901592 Inactive
>expiries=133410564 Inactive timeout=15 Active timeout=1800 }
>
>
>Now I am generating v5 netflow as well so I can compare - which I am
>seeing on the collector.  I can turn that off and just leave v9 on if that
>helps for debugging purposes.
>
>>
>> > 1) bce0 -> in promiscuous mode listening to traffic off of a tap
>>
>>Does bce0 have both UP and RUNNING flags set ?
>
>Yup.  Status is:
>
>bce0: flags=28943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,PPROMISC>
>metric 0 mtu 1500
>	options=c01bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM
>,
>TSO4,VLAN_HWTSO,LINKSTATE>
>	ether 00:19:b9:**:**:**
>	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
>	media: Ethernet autoselect (1000baseT <full-duplex>)
>	status: active
>
>
>--Brent
>