I checked the data using flow-print -f5 and sure enough there are quite a
number of zero-packet/zero-octet flows. In one 15 minute sample 504 out of
2825 were zero. This is being exported from a Juniper M10i with the
Adaptive Services PIC.
The zero packet flows seem to come in bursts. Good flows will accumulate
with a smooth time progression (i.e., each flow is very close to the
previous one in time) and then abruptly the times get messed up (e.g.,
including a 16 day long flow) and the zero packet flows appear. The good
flows reappear and the time sequence smooths out again until another burst
of bad flows.
Removal of
flow-inactive-timeout 15;
flow-active-timeout 60;
from the Juniper config seems to have fixed the problem as a temporary (?)
work around.
Joe
Mark Fullmer
<maf To: Joe Loiacono/CIV/[EMAIL
PROTECTED]
@splintered.net> cc: [EMAIL PROTECTED]
Subject: Re: [Flow-tools] Ignoring
bogus flow dPkts=0
03/30/2004 09:13
PM
It's a flow with the packet count of zero. Where are these flows
originating from?
--
mark
On Mar 26, 2004, at 4:04 PM, Joe Loiacono wrote:
> Anybody know what might be causing the following error message to
> appears
> 10s of thousands of times:
>
> "Ignoring bogus flow dPkts=0"
>
> when attempting:
>
> flow-stat -f0 < /testing/daily_filtered
>
> Thanks!
>
> Joe
>
> _______________________________________________
> Flow-tools mailing list
> [EMAIL PROTECTED]
> http://mailman.splintered.net/mailman/listinfo/flow-tools
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
