[netflow-tools] Softflowd not recognizing interface index
jason at dixongroup.net
Mon May 23 13:20:04 EST 2005
On May 22, 2005, at 11:11 PM, Damien Miller wrote:
> Jason Dixon wrote:
>> I've dropped pfflowd to try out softflowd as it appears to be a bit
>> more "compliant" than the pfflowd exports. However, I notice that my
>> flows still don't seem to be reporting the correct index numbers for
>> the interfaces. I'm not very SNMP savvy, so perhaps it's my own
>> inexperience showing. Can someone please explain to me why the
>> following output all have 0 as the if_index_in and if_index_out for
>> all flows?
>> A good example is seen on lines 1-2 and 8-9. Each pair represents
>> the same SSH session but they appear to come from different softflowd
>> agents (first from the external interface, then the internal).
>> Regardless, they all report an if_index_* of 0, no matter the
>> direction or agent.
> Yes, softflowd doesn't get enough information from bpf to fill these
> If you can figure out a way to get interface names of indices out of
> libpcap I can fix it easily.
Hell, I don't even grok the significance of the if_index_* stuff, other
than to assume that it's somehow valuable. I would think that the
reporting agent would always report its own interface as 0, but what do
I know. :)
Unfortunately, what I know about pcap could fit into a bottlecap.
More information about the netflow-tools