Yes, the ports, vlan and tos are also jacked-up for me:
TAG, SRC_MAC, DST_MAC, VLAN, SRC_IP, DST_IP,
SRC_PORT, DST_PORT, PROTOCOL, TOS, PACKETS, FLOWS, BYTES
7, dc:9f:db:28:ff:aa, 24:a4:3c:3d:51:e2, 0, 10.1.0.91, 10.2.0.195,
1935, 55750, tcp, 0, 957956, 1, 1338738381
{"tag": 7, "tos": 2155905152, "ip_proto": "tcp", "mac_dst":
"24:a4:3c:3d:51:e2", "mac_src": "dc:9f:db:28:ff:aa", "vlan": 2155905152,
"ip_src": "10.1.0.91", "port_src": 8312917622912, "ip_dst": "10.2.0.195",
"port_dst": 239446582657152, "
packets": 962493, "flows": 1, "bytes": 1345089033}
On Fri, Feb 21, 2014 at 12:09 PM, Stig Thormodsrud <sthor...@gmail.com>wrote:
> Sure I can try that. I'm wondering if it's a big endian issue? My
> platform is MIPS64.
>
> stig
>
>
> On Fri, Feb 21, 2014 at 11:44 AM, Paolo Lucente <pa...@pmacct.net> wrote:
>
>> Hi Stig,
>>
>> I tried to reproduce the issue with no joy, ie. all works good. I
>> suspect this might be something architecture specific - what CPU
>> is this?
>>
>> Thing is input/output interface fields are u_int32_t and using 'i'
>> would get us in trouble reading from NetFlow/sFlow exporters where
>> interfaces have high numbering; can you test you actually get the
>> same issue against some other fields packed as 'I', ie. src/dst
>> network masks (defined as u_int8_t) and UDP/TCP ports (defined as
>> u_int16_t)?
>>
>> Cheers,
>> Paolo
>>
>> On Thu, Feb 20, 2014 at 03:11:16PM -0800, Stig Thormodsrud wrote:
>> > Hi Paolo,
>> >
>> > I've been experimenting with the new json output - nice addition. One
>> > thing I ran into was that the iface value was wrong. For example here's
>> > the csv output compared with the json output:
>> >
>> > root@ubnt-SJ:/etc/pmacct# pmacct -p /tmp/uacctd-e.pipe -s -T bytes -O
>> csv
>> > TAG,IN_IFACE,OUT_IFACE,DST_IP,PACKETS,BYTES
>> > 7,7,15,10.1.6.191,55864,81578675
>> >
>> > root@ubnt-SJ:/etc/pmacct# pmacct -p /tmp/uacctd-e.pipe -s -T bytes -O
>> json
>> > {"tag": 7, "ip_dst": "10.1.10.10", "iface_out": 36515643520, "iface_in":
>> > 32220676224, "packets": 59789, "bytes": 85446840}
>> >
>> > I think the problem might be that the jansson library is treating at 16
>> bit
>> > value as 64 bits. If I change it to:
>> >
>> > diff --git a/src/pmacct.c b/src/pmacct.c
>> > index 2fb915a..ea79788 100644
>> > --- a/src/pmacct.c
>> > +++ b/src/pmacct.c
>> > @@ -2929,13 +2929,13 @@ char *pmc_compose_json(u_int64_t wtc, u_int64_t
>> > wtc_2, u
>> > }
>> >
>> > if (wtc & COUNT_IN_IFACE) {
>> > - kv = json_pack("{sI}", "iface_in", pbase->ifindex_in);
>> > + kv = json_pack("{si}", "iface_in", pbase->ifindex_in);
>> > json_object_update_missing(obj, kv);
>> > json_decref(kv);
>> > }
>> >
>> > if (wtc & COUNT_OUT_IFACE) {
>> > - kv = json_pack("{sI}", "iface_out", pbase->ifindex_out);
>> > + kv = json_pack("{si}", "iface_out", pbase->ifindex_out);
>> > json_object_update_missing(obj, kv);
>> > json_decref(kv);
>> > }
>> >
>> >
>> > Then I get:
>> >
>> > root@ubnt-SJ:/etc/pmacct# pmacct -p /tmp/uacctd-e.pipe -s -T bytes -O
>> json
>> > {"tag": 7, "ip_dst": "10.1.10.10", "iface_out": 8, "iface_in": 7,
>> > "packets": 119479, "bytes": 170724634}
>> >
>> > Not sure if that is the correct fix.
>> >
>> > stig
>>
>> > _______________________________________________
>> > pmacct-discussion mailing list
>> > http://www.pmacct.net/#mailinglists
>>
>>
>> _______________________________________________
>> pmacct-discussion mailing list
>> http://www.pmacct.net/#mailinglists
>>
>
>
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
