[netflow-tools] Softflowd and rrd running on the same machine

[Damien Miller]

Bogdan Ghita wrote:
> 15:01:21.226594 IP (tos 0x0, ttl  64, id 37956, offset 0, flags [DF],
> length: 1444) tester.32782 > tester.2000: NetFlow v5, 261587.476 uptime,
> 1115042481.225734000, #92236610, 29 recs
> 15:01:21.227292 IP (tos 0x0, ttl  64, id 37957, offset 0, flags [DF],
> length: 1444) tester.32782 > tester.2000: NetFlow v5, 261587.476 uptime,
> 1115042481.225734000, #92236610, 29 recs
> 
> I've looked at print-cnfp.c within tcpdump and the # values are the
> sequence numbers within Netflow. I am not sure why they remain the same
> between datagrams (are they supposed to? the specification says that
> they should be increased with the corresponding number of flows every
> time a new datagram arrives), but one thing is sure - there is no gap in
> the id numbers, so no datagrams are lost in the process. Related to
> this, I've changed the expiry interval to 10 seconds, hoping to get more
> granularity (and less loss, due to reduced bursts) - has anybody
> obtained better/worse results while varying the expiry interval?

This is a bug in softflowd. The fix is attached :)

Please test and let me know whether it helps.

-d
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: softflowd-seqno.diff
Url: http://lists.mindrot.org/pipermail/netflow-tools/attachments/20050503/450c924f/attachment.ksh