I continue to see only two active interfaces, despite running at the current release (1.6.15) with -Tall used on nfcapd.
Several hours of netflow collected.
Example:
$ ./nfcapd -Tall -p2055 -l test
Add extension: 2 byte input/output interface index
Add extension: 4 byte input/output interface index
Add extension: 2 byte src/dst AS number
Add extension: 4 byte src/dst AS number
Add extension: dst tos, direction, src/dst mask
Add extension: IPv4 next hop
Add extension: IPv6 next hop
Add extension: IPv4 BGP next IP
Add extension: IPv6 BGP next IP
Add extension: src/dst vlan id
Add extension: 4 byte output packets
Add extension: 8 byte output packets
Add extension: 4 byte output bytes
Add extension: 8 byte output bytes
Add extension: 4 byte aggregated flows
Add extension: 8 byte aggregated flows
Add extension: in src/out dst mac address
Add extension: in dst/out src mac address
Add extension: MPLS Labels
Add extension: IPv4 router IP addr
Add extension: IPv6 router IP addr
Add extension: router ID
Add extension: BGP adjacent prev/next AS
Add extension: time packet received
Add extension: NSEL Common block
Add extension: NSEL xlate ports
Add extension: NSEL xlate IPv4 addr
Add extension: NSEL xlate IPv6 addr
Add extension: NSEL ACL ingress/egress acl ID
Add extension: NSEL username
Add extension: NSEL max username
Add extension: nprobe latency
Add extension: NEL Common block
Add extension: Compat NEL IPv4
Add extension: NAT Port Block Allocation
Bound to IPv4 host/IP: any, Port: 2055
Startup.
Init IPFIX: Max number of IPFIX tags: 62
Process_v9: New exporter: SysID: 1, Domain: 1536, IP:
xxx.xxx.xxx.xxx
Process_v9: New exporter: SysID: 2, Domain: 2304, IP:
xxx.xxx.xxx.xxx
Process_v9: [1536] Add template 261
Process_v9: [2304] Add template 264
Process_v9: New exporter: SysID: 3, Domain: 6, IP: xxx.xxx.xxx.xxx
Ident: 'none' Flows: 121787, Packets: 2817842, Bytes: 964336588,
Sequence Errors: 0, Bad Packets: 0
Total ignored packets: 0
Ident: 'none' Flows: 170635, Packets: 3797907, Bytes:
1195265191, Sequence Errors: 0, Bad Packets: 0
Total ignored packets: 0
~/nfdump-master/bin
$ ./nfdump -R test/nfcapd.201610310707 -s if
Top 10 In/Out If ordered by -:
Date first seen Duration Proto In/Out If
Flows(%) Packets(%) Bytes(%) pps bps bpp
1969-12-31 18:00:00.000 0.000 any 0 6.5
M(100.0) 155.8 M(100.0) 57.8 G(100.0) 0 0 370 ==>
valid interface
1969-12-31 18:00:00.000 0.000 any 5 6.5
M(100.0) 155.8 M(100.0) 57.8 G(100.0) 0 0 370 ==>
valid interface - but there should be others
Summary: total flows: 6482725, total bytes: 57763340316, total
packets: 155829540, avg bps: 0, avg pps: 0, avg bpp: 0
Time window: 2016-10-31 07:07:25 - 2016-10-31 10:22:25
Total flows processed: 6482725, Blocks skipped: 0, Bytes read: 544564296
Sys: 0.795s flows/second: 8154371.1 Wall: 0.795s flows/second:
8148221.5
I will compare with nprobe.
Any advice appreciated.
On 10/31/2016 12:05 AM, James A. Klun wrote:
I recompiled - with some effort - with the current github source
$ ./nfcapd -V
nfcapd: Version: 1.6.15 ( was 13)
smime.p7s
Description: S/MIME Cryptographic Signature
------------------------------------------------------------------------------ Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE. Training and support from Colfax. Order your platform today. http://sdm.link/xeonphi
_______________________________________________ Nfdump-discuss mailing list Nfdump-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
