Hi I am runing softflowd in my PC with following command #softflowd -D -v 9 -i eth1 -n192.168.100.2:5555 -t maxlife=10 -t expint=10 And it is not sending v9 template flow set immadiately. If I create some ICMP session with #ping 192.168.100.254 -c 4 then it is sending template flow set but not data flow set with the ICMP session data. If I do ping again then it is sending data flow set with the ICMP session data. So we are missing first data flow set. I am attaching the debug info with this mail. Regards Koteswar -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.mindrot.org/pipermail/netflow-tools/attachments/20090819/d4c59a6a/attachment.html> -------------- next part -------------- A non-text attachment was scrubbed... Name: debugLog Type: application/octet-stream Size: 6925 bytes Desc: not available URL: <http://lists.mindrot.org/pipermail/netflow-tools/attachments/20090819/d4c59a6a/attachment.obj>
On Wed, 19 Aug 2009, Koteswar wrote:> Hi > I am runing softflowd in my PC with following command > #softflowd -D -v 9 -i eth1 -n192.168.100.2:5555 -t maxlife=10 -t expint=10 > And it is not sending v9 template flow set immadiately. If I create some > ICMP session with > #ping 192.168.100.254 -c 4 > then it is sending template flow set but not data flow set with the ICMP > session data. > If I do ping again then it is sending data flow set with the ICMP session > data. So we are missing first data flow set. I am attaching the debug info > with this mail.>From the start of your debuglog:> Finished scan 2 flow(s) to be evicted > Flow 1/0: r 0 offset 159 type 0004 len 35(0x0023) flows 1 > Flow 1/1: r 0 offset 190 type 0004 len 66(0x0042) flows 2 > Sending flow packet len = 192This packet length certainly looks like a template flowset + two flows. Can you try to catch the problem with tcpdump? -d