I've been unsuccessfully trying to convert files in DAG format to Netflow. To achieve this I first converted the DAG files to pcap using tshark and then exported the pcap files using softflowd to a Netflow collector (flow-capture). But every time I do the export from pcap, softflowd seems to ignore all the IP packets. The exact output that I get is:
<br><br># softflowd -r 26f0000.pcap -n <a href="http://192.168.1.7:8819">192.168.1.7:8819</a> -d<br>softflowd v0.9.8 starting data collection<br>Exporting flows to [<a href="http://192.168.1.7">192.168.1.7</a>]:8819<br>Shutting down after pcap EOF
<br>Shutting down on user request<br>Number of active flows: 0<br>Packets processed: 0<br>Fragments: 0<br>Ignored packets: 6918507 (6918507 non-IP, 0 too short)<br>Flows expired: 0 (0 forced)<br>Flows exported: 0 in 0 packets (0 failures)
<br>#<br><br>I've tried breaking down the pcap file (which is around 650 MB) to smaller files sizes using tcpslice but that does not seem to help either. <br>I've also used tools like dagconvert (from Endace) to convert DAG to pcap and run it through softflowd, but in this case too softflowd seems to ignore all packets. I am able to export pcap to Netflow using softflowd when the pcap file is created using a live capture.
<br>I would really appreciate it if someone could help me out on this problem or offer a better way on how I can do the conversion.<br>Thanks.<br>-santosh<br>