>Just to throw more uncertainty and rumor into the mix, I've known 6500s to
>produce netflow PDUs with 0.0.0.0 source and destination ips, presumably
>because of some bug (i.e. I looked hard and didn't see any traffic to or
>from anybody claiming to actually be 0.0.0.0)
It's been awhile, but I seem to recall that 0.0.0.0 was used as an address for
routing continuation fragments, so the original SIP and DIP would be in a
previous flow...
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
