[Nfsen-discuss] Can't dump IOS XR Netflow v9 AS info

2012-12-21 Thread Jason Lixfeld
I might be missing something, but I dunno.. I've attached a wireshark capture, a nfcapd -E dump and a nfdump -o cap to try to illustrate my question. The wireshark capture, nfcapd capture and nfdump capture are not from the same flow. I'm just using them as examples.. My XR box is exporting

Re: [Nfsen-discuss] Can't dump IOS XR Netflow v9 AS info

2012-12-27 Thread Jason Lixfeld
On 2012-12-22, at 5:49 AM, Peter Haag ph...@users.sourceforge.net wrote: nfdump supports both type of AS numbers. The first pair as src/dst AS the second as next/prev AS, however they are not the same. It depends, what tags your nox exports. ASes are suppoerted as 2 or 4 bytes. Hope, this

Re: [Nfsen-discuss] Can't dump IOS XR Netflow v9 AS info

2012-12-27 Thread Jason Lixfeld
On 2012-12-27, at 10:32 AM, Jason Lixfeld jason-nfsen-disc...@lixfeld.ca wrote: I suppose for the latter I can custom compile per the man page, but I don't know what to do about the -s bits. I may have to eat crow - I think I can only custom compile entire format lines, not format tags

Re: [Nfsen-discuss] Can't dump IOS XR Netflow v9 AS info

2013-01-04 Thread Jason Lixfeld
On 2013-01-04, at 10:54 AM, Mark D. Nagel mna...@willingminds.com wrote: On 1/4/2013 7:48 AM, Jason Lixfeld wrote: Anyone using IOS-XR and have sampling working or know why it might not work? You showed your map definitions -- what is the interface configuration? For example: RP/0/RSP0

[Nfsen-discuss] Troubleshooting some odd looking nfdump output

2013-01-04 Thread Jason Lixfeld
Hi there, So I'm just playing around with my first 36 hours worth of data and I'm seeing some stuff that looks sort of off: ** nfdump -M /opt/nfsen/profiles-data/live/bfr01-hudson:bfr01-mowat:bfr01-front -T -R 2013/01/02/nfcapd.201301022305:2013/01/04/nfcapd.201301041055 -n 10 -s as/bps

Re: [Nfsen-discuss] Can't dump IOS XR Netflow v9 AS info

2013-01-04 Thread Jason Lixfeld
On 2013-01-04, at 11:24 AM, Mark D. Nagel mna...@willingminds.com wrote: OK, that looks right. You might want to capture and post some raw flows with tcpdump so they can be examined to see if the sampler information is really present in the resulting datagrams. There was a similar thread

[Nfsen-discuss] Preventing gateway timeout

2013-01-10 Thread Jason Lixfeld
While trying to chew through anything more than a few days worth of data, I'm faced with a 504 Gateway Time-out error. Is that something that can be fixed within Nfsen or is that a web server thing? CentOS 6.3/Apache 2.2.15/nfsen 1.3.6p1. Thanks.

Re: [Nfsen-discuss] Troubleshooting some odd looking nfdump output

2013-01-11 Thread Jason Lixfeld
PM, Jason Lixfeld jason-nfsen-disc...@lixfeld.ca wrote: Thanks all for your replies. So I guess for what I'm looking for, dropping the sample rate to the point where it just hovers on the HW limits of my platform is probably where I want to be. So hypothetically speaking, what's

[Nfsen-discuss] nfdump -t including dates in the future?

2013-01-11 Thread Jason Lixfeld
I'm experimenting with the -t flag to automate report creation. My thought was to run it in a cron job at the beginning of every month to tell me how much traffic I'm exchanging with top N ASNs. My understanding of the -t flag is that it will reel back to as close to the beginning of the

Re: [Nfsen-discuss] Preventing gateway timeout

2013-01-14 Thread Jason Lixfeld
On 2013-01-10, at 3:08 PM, Peter Haag ph...@users.sourceforge.net wrote: On 10/1/13 4:40 PM, Jason Lixfeld wrote: While trying to chew through anything more than a few days worth of data, I'm faced with a 504 Gateway Time-out error. Is that something that can be fixed within Nfsen

Re: [Nfsen-discuss] [SOLVED] Re: Can't dump IOS XR Netflow v9 AS info

2013-01-14 Thread Jason Lixfeld
ipv4 exporter fem ! sampler-map sm random 1 out-of 1000 ! On 2013-01-11, at 3:03 PM, Jason Lixfeld jason-nfsen-disc...@lixfeld.ca wrote: Just for the archives - The default template timeout in XR is 1800 seconds. I guess this is too long for nfSen before it gives up and assumes

Re: [Nfsen-discuss] Preventing gateway timeout

2013-01-14 Thread Jason Lixfeld
can write your own plugin. Otherwise, you can achieve the same result with cron and shell scripts to collect and parse the data... But it's like a DIY kit - some assembly required :) On Mon, Jan 14, 2013 at 10:05 PM, Jason Lixfeld jason-nfsen-disc...@lixfeld.ca wrote: Which plugin