[netflow-tools] CISCO HDLC Pcap format

[Guanqun Lu]

On 3/29/07, Damien Miller <djm at mindrot.org> wrote:
> On Wed, 21 Feb 2007, Víctor López Álvarez wrote:
>
> > I have tried to change from Pcap format to Netflow using softflowd but
> > it say me that the format I use is not support. However, I can extract
> > information using tcpdump, so I wonder why  softflowd say me that is an
> > unsupported datalink type.
> >
> > Anyone knows which is the reason?
>
> Because support for it has not been implemented.
>
> > Besides, how could I add the support for this header?
>
> Near the start of softflowd.c there is a definition of "struct DATALINK"
> and a table of supported datalink types "lt[]". struct DATALINK defines
> where in the layer-2 frame softflowd should look for the frame type, how
> to extract it and how to interpet it to determine whether a frame represents
> a IPv4 or IPv6 packet.
>
> Adding a new frame type to softflowd is as simple as adding an entry to
> this array.

I'm wondering whether it's easy to collect other packet information such as MPLS
and VPN.

>
> -d
> _______________________________________________
> netflow-tools mailing list
> netflow-tools at mindrot.org
> http://lists.mindrot.org/mailman/listinfo/netflow-tools
>
>

Thanks,
-- 
Guanqun