Actually the lost counts really aren't that high. What you're seeing is that (from the first line) flow-fanout was expecting UDP packet numbered 7959254 but received UDP packet numbered 5834414, so teh difference is 5834414 - 7959254 = -2124840. This gets represented by 2**32 - 2124840 = 4292842455.
What is probably happening is you are exporting from two different sources and flow-fanout is confusing the data streams. Sometimes this can happen from a single device (e.g., 6509) where the switch and MLS exporters are represented with different IP addresses. There is a more detailed discussion of this on the mailing list archives. Joe "Koski, David" <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 11/07/2008 08:26 AM To "[email protected]" <[email protected]> cc Subject [Flow-tools] flow-fanout error We just brought a new RHEL5 x64 box online and are seeing spurious errors to the logs where the lost count is very high. Has anyone seen this before? Is there any patch for it (We are running the googlecode fork, latest stable version): Nov 7 08:24:30 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=7959254 received=5834414 lost=4292842455 Nov 7 08:24:30 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=5834906 received=7959254 lost=2124348 Nov 7 08:24:30 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=7960275 received=5834906 lost=4292841926 Nov 7 08:24:31 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=5838510 received=7960275 lost=2121765 Nov 7 08:24:31 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=7960432 received=5838510 lost=4292845373 Nov 7 08:24:33 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=1683581 received=2854 lost=4293286568 Nov 7 08:24:34 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=2863 received=1683581 lost=1680718 Nov 7 08:24:35 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=1685635 received=2863 lost=4293284523 Nov 7 08:24:36 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=2877 received=1685635 lost=1682758 Nov 7 08:24:36 bin-a flow-fanout[18249]: ftpdu_seq_check(): src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=1686133 received=2877 lost=4293284039 Thanks David _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
