Hi Rene, It suggests some records are corrupted and cannot be read to the end, ie. they are read only partly. Then a length value is hit, in the datagram, that would let pmacct read beyond the real length of the packet as received on the wire.
Paolo On Mon, Sep 12, 2016 at 03:51:07PM +0200, Rene Stoutjesdijk wrote: > Goodday, > > Since a few days i do see a huge amount off the following error messages > (from cisco 6509, replaced ip with a.b.c.d): > > Sep 11 12:26:14 INFO: unable to read next Flowset (incomplete NetFlow > v9/IPFIX packet): nfacctd= <http://0.0.0.0:2055> 0.0.0.0:2055 > agent=a.b.c.d:53682 seq=275719311 > > Sep 11 12:26:14 INFO: unable to read next Flowset (incomplete NetFlow > v9/IPFIX packet): nfacctd= <http://0.0.0.0:2055> 0.0.0.0:2055 > agent=a.b.c.d:53682 seq=275719334 > > Sep 11 12:26:14 INFO: unable to read next Flowset (incomplete NetFlow > v9/IPFIX packet): nfacctd= <http://0.0.0.0:2055> 0.0.0.0:2055 > agent=a.b.c.d:53682 seq=275719357 > > Sep 11 12:26:14 INFO: unable to read next Flowset (incomplete NetFlow > v9/IPFIX packet): nfacctd= <http://0.0.0.0:2055> 0.0.0.0:2055 > agent=a.b.c.d:53682 seq=275719380 > > Sep 11 12:26:14 INFO: unable to read next Flowset (incomplete NetFlow > v9/IPFIX packet): nfacctd= <http://0.0.0.0:2055> 0.0.0.0:2055 > agent=a.b.c.d:53682 seq=275719403 > > > > > > What does this mean? Does this imply that certain packets are lost, or some > ipfix records corrupt, or missing sequence numbers,. > > > > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
