Hey guys, I just wanted to take this time to do a quick follow up.
As far as printing the output goes, I'm thinking somewhere along the lines
of an extra column called "RD" if that's what you mean.
The actual value should be contained in the data flowset. I took a pcap
capture of this but unfortunately I'm running into some trouble decoding it
using wireshark. I haven't had the time to try a different pcap analysis
tool yet and I'm not really sure if there is even such a tool. I can see
the options template flowset, but the data flowset after that is flagged as
corrupt/malformed. I believe this data flowset contains the actual RD value
among other things but is flagged as malformed because it contains no flow
information according to wireshark so it could be an implementation issue
with the decode feature used in wireshark. I'll have to see if I can decode
it manually somehow. Also, it seems Nfdump is also seeing this data flowset
as corrupt because it is showing so in the syslog:
Jan 5 21:50:41 sentinel nfcapd[26148]: Process_v9: flowset length error.
'4' is too short for a flowset
Jan 5 21:50:44 sentinel nfcapd[26148]: Process_v9: flowset length error.
'4' is too short for a flowset
Jan 5 21:50:44 sentinel nfcapd[26148]: Process_v9: flowset length error.
'4' is too short for a flowset
Again, this could also be due to lack of support in Nfdump where a flowset
is probably expected to be larger than 4 bytes.
The snap I took is about 21 MBytes, I could trim it down if you want/need.
Where can I send it?
Also, you might want to take a look at
http://www.cisco.com/en/US/docs/ios/12_2sb/feature/guide/sx_pal.html#wp1055653
In the example, there is a brakedown of the mentioned 8 byte array showing
the two key components that make up the RD value.
Phil's input applies here. The 100 suggests that the type value was set to
0. The integer value is 1 but the picture suggests that the integer is
stored prepended with a colon in the data flowset.
I'm not really sure if that makes a difference for implementation though.
You could probably concatenate the values of the array while processing the
flowset and optimistically it would end up showing correctly.
The Cisco gear we use supports two ways of exporting this data in Netflow.
It can be done periodically or it can be done upon allocation of label
information. Right now I have it set up to export the full PAL table
periodically. Every 5 minutes to be exact.
Regards,
Kimaru
On Tue, Jan 3, 2012 at 12:59 PM, Phil Mayers <[email protected]>wrote:
> On 03/01/12 11:51, Peter Haag wrote:
>
> > According to the spec, this is an 8byte array. Do you have further
> information about
> > MPLS PAL RD in general, and how you would like this data to be printed?
> The white
> > paper only refers to the tag as such whithout any details.
>
>
> I am guessing the encoding as as per section 4.2 of RFC 4364:
>
> 2 bytes type
> 6 bytes value
>
> type==0, then value:
>
> 2 bytes AS number
> 4 bytes integer
>
> type==1, then value:
>
> 4 bytes IPv4 address
> 2 bytes integer
>
>
> ------------------------------------------------------------------------------
> Write once. Port to many.
> Get the SDK and tools to simplify cross-platform app development. Create
> new or port existing apps to sell to consumers worldwide. Explore the
> Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join
> http://p.sf.net/sfu/intel-appdev
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
------------------------------------------------------------------------------
Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
infrastructure or vast IT resources to deliver seamless, secure access to
virtual desktops. With this all-in-one solution, easily deploy virtual
desktops for less than the cost of PCs and save 60% on VDI infrastructure
costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
