-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Kees,
The SVN archive is outdated - I need to updated the online version control
anyway, as I use an internal SVN archive. I disabled SVN for the moment, as
I need a reliable solution to sync SVNs.
As for your coredump - could you please download nfdump-1.6.1 from Sourceforge
and give it another try. If it still fails, I'd happily will debug the case.
Regards
- Peter
Kees Leune wrote:
> Hello,
>
> As much as I try not to, it seems that most of the time I write my first
> message to a newly subscribed mailing list, I need to ask for some help.
> This is one of those messages ;)
>
> After having run nfsen/nfdump in a pilot setting on some old decrepit
> hardware for a few weeks to see if it provides the level of insight into our
> network traffic that we were looking for, I purchased a shiny new server and
> installed it with an Ubuntu 64-bit operating system. Nfdump (from the SVN
> repository) compiled easily and nfsen followed rapidly after. Starting the
> processes was as easy as it was during my pilot. However, when I asked my
> NOC to redirect one of our netflows to go to the new machine, nfcapd
> consistently crashes on the first packet it receives.
>
> Invocation:
>
> r...@mississippi:/opt/nfsen/bin# /opt/nfdump/bin/nfcapd -w -I core-hagedorn
> -p 9998 -u netflow -g www-data -B 200000 -S 1 -l
> /opt/nfsen/profiles-data/live/core-hagedorn -P
> /opt/nfsen/var/run/core-hagedorn.pid
> Segmentation fault
>
> If it helps, I can produce a core.
>
> The corresponding entries from my syslog are:
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 2
> byte input/output interface index
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
> byte input/output interface index
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 2
> byte src/dst AS number
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
> byte src/dst AS number
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
> dst tos, direction, src/dst mask
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
> IPv4 next hop
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
> IPv6 next hop
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
> IPv4 BGP next IP
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
> IPv6 BGP next IP
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
> src/dst vlan id
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
> byte output packets
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 8
> byte output packets
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
> byte output bytes
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 8
> byte output bytes
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
> byte aggregated flows
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 8
> byte aggregated flows
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: in
> src/out dst mac address
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: in
> dst/out src mac address
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
> MPLS Labels
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Bound to IPv4
> host/IP: any, Port: 9998
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Standard
> setsockopt, SO_RCVBUF is 129024 Requested length is 200000 bytes
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: System set
> setsockopt, SO_RCVBUF to 262142 bytes
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Startup.
> Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Init v9:
> Recognised number of v9 tags: 54
> Mar 4 10:52:06 mississippi /opt/nfdump/bin/nfcapd[23060]: Process_v5: New
> exporter engine id 0, type 0
> Mar 4 10:52:06 mississippi kernel: [172970.205601] nfcapd[23060]: segfault
> at 9ba2f01c ip 00007fdf9b4155a7 sp 00007fffb9fa8b68 error 6 in
> libc-2.10.1.so[7fdf9b393000+166000]
>
> I did notice a patch for an uninitialized variable that circulated a little
> while ago, but it does not seem to apply to the current trunk.
>
> At this time, I am obviously reverting back to my old machine. However,
> given its state, I am not sure how much longer it will be able to keep up
> with the data. Is this a known issue? If so, what can I do to fix it? If
> not, what can I do to help solve it?
>
> -Kees
>
>
>
> ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------------
> Download Intel® Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [email protected] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBS5C2Ov5AbZRALNr/AQJbVwP/b3ak4cQZkH8n82weUe/n//x5DkH1ObU8
tbG3Hi4bpGgy0EEShr1GFwnOV04J3O3/UEhKA8j2MU7nhUcdMogsJvZZNCh15oKN
BbgY80a9g6On3xEDiIex3XGVFC4s4Y0ERqDCnzXkSPjXS9UseJOvyNC8s0gKnmJR
tRbGG47GrxI=
=scru
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
