Thanks Hektor for the report. Do you have me a pcap to the collector for
testing?
Just send it offlist to me. That would help.
Thanks
- Peter
On 03/09/15 11:37, Jens Hektor wrote:
> OK, @Peter:
>
> it looks like that if we use NAT64 there are no records in the nfcap-Files
> for the
OK, @Peter:
it looks like that if we use NAT64 there are no records
in the nfcap-Files for the "X-Src IP Addr" (aka %xsa or %nsa)
as these are IPv4 addresses.
Seems that some logic ("there is an 'IPv6 source' and 'X-Dst IP Addr'")
prevents entries of IPv4 addresses (!) into "Dst IP Addr" and
Try running your collector with the "-T all" option to capture all
extensions. See nfcapd's man page (search for -T). Your %sources hash entry
should look like this:
'76xx_lab' => { 'port' => '9902', 'col' => '#00', 'type' =>
'netflow', 'optarg' => '-T all' },
On Tue, Sep 1, 2015 at
