Thanks for the feedback. I'll check that!
- Peter
On 19.05.14 18:25, Matej Gregr wrote:
> Hi Peter,
> if I aggregate according the netmask I receive wrong results. Probably
> all nfdump versions are affected (tested with 1.6.12, 1.6.11, 1.6.10)
> The bug is however not connected with aggregation but with printing the
> flow cache.
>
> Example:
> nfcapd.test contains one flow:
> 141.3.120.67:38098 -> 12.30.26.218:25507
>
> Nothing is printed with the following command:
> nfdump -r nfcapd.test -A srcip4/24
>
> This command works:
> nfdump -r nfcapd.test -A srcip4/16
> Src IP Addr Packets
> 141.3.0.0 1
>
>
> I have been digging around the source code and I believe, that a
> condition for flowcache iteration is wrong in nfstat.c PrintFlowTable().
> In the rare case, where the flow record is in the last position in the
> cache (the index has the same value as the FlowTable.IndexMask), you
> will not print the record, because you iterate the table with following
> code:
>
> for ( i=0; i<FlowTable->IndexMask; i++ ) {
> }
>
> The condition should be probably:
> i <= FlowTable->IndexMask
>
> Patch solving the issue is attached. Hope you will find it useful.
>
> Sincerely,
> Matej
>
>
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos.
> Get unparalleled scalability from the best Selenium testing platform available
> Simple to use. Nothing to install. Get started now for free."
> http://p.sf.net/sfu/SauceLabs
>
>
>
> _______________________________________________
> Nfdump-discuss mailing list
> Nfdump-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
