[netflow-tools] flowd + avici v9 flows problem
djm at mindrot.org
Fri Jul 8 10:39:43 EST 2005
Gijs Molenaar wrote:
> Damien Miller wrote:
>>Please try the attached diff. It won't drop the packets any more, but
> It works! But now I'm getting the same error for field type 17 :). This
> is NF9_DST_AS. The daft describes that the lenght for these fields
> should be 2 or 4. The same for NF9_SRC_AS*. When I look at your code, it
> only supports lenght 2.*
Actually more work is needed - my patch will clobber adjacent fields.
I'm working on a better one now.
>>the flowd log format only has a 2 octet space to store the SNMP
>>interface indices, so the most signficant two octets will be ignored.
> Will the flowd log format support variable length for these fields in
> the future?
That't what I'm working on now :)
BTW. If anyone wants fields added to the flowd log format, now is
the time to speak up. So far I'm:
- Extending src/dst AS to 32 bits each
- Extending in/out SNMP indices to 32 bits each
- Adding NetFlow v.9 source_id to FLOW_ENGINE_INFO
- Probably adding NetFlow v.9 min/max packet length.
Any more fields that you want?
(I'm trying to make the changes backwards-compatible, so a new flowd
will be able to read an old flowd's logs, but probably not write or
append to them.)
More information about the netflow-tools