<br><div><span class="gmail_quote">On 2/13/07, <b class="gmail_sendername">Damien Miller</b> <<a href="mailto:djm@mindrot.org">djm@mindrot.org</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Mon, 12 Feb 2007, Santosh Rao wrote:<br><br>> I've been unsuccessfully trying to convert files in DAG format to Netflow.<br>> To achieve this I first converted the DAG files to pcap using tshark and<br>> then exported the pcap files using softflowd to a Netflow collector
<br>> (flow-capture). But every time I do the export from pcap, softflowd seems to<br>> ignore all the IP packets. The exact output that I get is:<br>><br>> # softflowd -r 26f0000.pcap -n <a href="http://192.168.1.7:8819">
192.168.1.7:8819</a> -d<br>> softflowd v0.9.8 starting data collection<br>> Exporting flows to [<a href="http://192.168.1.7">192.168.1.7</a>]:8819<br>> Shutting down after pcap EOF<br>> Shutting down on user request
<br>> Number of active flows: 0<br>> Packets processed: 0<br>> Fragments: 0<br>> Ignored packets: 6918507 (6918507 non-IP, 0 too short)<br><br>I don't know what DAG is, but your problem is described in the line above.
<br>softflowd is not recognising your pcap file as containing IP packets.<br>There are two possibilities the come to mind: first, your packet capture<br>may be corrupted enough to not be recognisable by softflow, but still
<br>be a valid pcap format. Second, the pcap file may have been written with<br>a datalink type that softflowd does not support.<br><br>Can you dump the file with "tcpdump -vvr 26f000.pcap"? If tcpdump can read<br>
it then perhaps it is a datalink type problem. Does running softflowd with<br>the "-D" (debug) option give any indication of what is wrong?<br><br>-d<br></blockquote></div><br><div><br>Damien,<br>Thanks for your response.
<br>
Here is the output when I run softflowd with the -D option.<br><br></div>
# softflowd -r /home/santosh/defeat/26f0000.pcap -n localhost:8819 -D<br><div id="mb_2"><span class="q">
softflowd v0.9.8 starting data collection<br></span>
Exporting flows to [<a href="http://127.0.0.1/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">127.0.0.1</a>]:8819<span class="q"><br>
Shutting down after pcap EOF<br>
Shutting down on user request<br></span>
Starting expiry scan: mode -1<br>
Finished scan 0 flow(s) to be evicted<span class="q"><br>
Number of active flows: 0<br>
Packets processed: 0<br>
Fragments: 0<br>
Ignored packets: 6918507 (6918507 non-IP, 0 too short)<br></span><div><span class="q" id="q_110e624395007c9b_9">Flows expired: 0 (0 forced)<br>
Flows exported: 0 in 0 packets (0 failures)</span></div></div>
<br>Thanks,<br>-santosh<br><br><span class="gmail_quote"></span>