-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Maurizio,
- --On January 16, 2007 17:39:57 +0000 Maurizio Molina <[EMAIL PROTECTED]> wrote: | Hi, | the last nfdump snapshot (20070110) seems to have problems with the -R | option: | | [EMAIL PROTECTED] man]$ | /opt/flowtest/tools/nfdump/snapshot-20070110/bin/nfdump -R | /opt/flowtest/tools/nfdump/snapshot-20070110/archive/ath_gr/ -I | Open file: bad version: 0 You must have created those files with an old pre-1.5 ( version <= nfdump-snapshot-20060721 ). When converted from old style nfdump 1.4, the version label was set to 0 instead of the valid nfdump file version. You must have pached your old nfdump version, as processing version 0 files resulted in errors for every nfdump 1.5.x. nfdump 1.4 files converted with nfdump-snapshot-20060809 and later are correct, and do not result in any errors. If you still need these files, I'd recommend you to convert them using the procedure below, as any future nfdump version will not read those files. 1. apply patch appended to snapshot-20070110. This enables you to blindly read version 0 files. 2. convert all files in that directory with the shell script: #!/bin/sh for file in `find . -name nfcapd.\*`; do echo Converting $file nfdump -r $file -w $file.tmp mv $file.tmp $file done | | If I run the same command with the stable 1.5 version on the same | directory (that, note, was created with snapshot-20070110) everything | works: | [EMAIL PROTECTED] man]$ /opt/flowtest/tools/nfdump/1.5/bin/nfdump -R | /opt/flowtest/tools/nfdump/snapshot-20070110/archive/ath_gr/ -I | Ident: ath_gr | Flows: 197653 | Flows_tcp: 179265 | Flows_udp: 17100 | Flows_icmp: 1276 | Flows_other: 12 | Packets: 273347 | Packets_tcp: 252754 | Packets_udp: 19283 | Packets_icmp: 1290 | Packets_other: 20 | Bytes: 214548633 | Bytes_tcp: 209720853 | Bytes_udp: 4725605 | Bytes_icmp: 84759 | Bytes_other: 17416 | First: 1168967906 | Last: 1168968566 | msec_first: 917 | msec_last: 863 | Sequence failures: 0 | | Regards, | Maurizio | | | ------------------------------------------------------------------------- | Take Surveys. Earn Cash. Influence the Future of IT | Join SourceForge.net's Techsay panel and you'll get the chance to share your | opinions on IT & business topics through brief surveys - and earn cash | http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV | _______________________________________________ | Nfsen-discuss mailing list | [email protected] | https://lists.sourceforge.net/lists/listinfo/nfsen-discuss - -- _______ SWITCH - The Swiss Education and Research Network ______ Peter Haag, Security Engineer, Member of SWITCH CERT PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iQCVAwUBRa3aOf5AbZRALNr/AQKvVwP5AeLvy4dU7x429KefKQ0bxtB1o9T4KHH6 pcOV4NsaUDfwi26PYmAdGhiUqdMAR07DcWBWRUTnqG9Vznc0oftqqpzoBIIXv3rC PznwWldNMyDWqe71UlTmlQ6gRMMyd+G3OoxUUjjpMyPncYlNnaUbIpLyNcmBn4sE aEUICJcZxpk= =jCi3 -----END PGP SIGNATURE-----
--- nffile.c.orig 2007-01-17 08:54:14.000000000 +0100
+++ nffile.c 2007-01-17 08:54:59.000000000 +0100
@@ -216,6 +216,9 @@
close(fd);
return -1;
}
+ if ( FileHeader.version == 0 ) {
+ FileHeader.version = VERSION;
+ }
if ( FileHeader.version != VERSION ) {
snprintf(error_string, ERR_SIZE,"Open file: bad version: %u\n",
FileHeader.version );
error_string[ERR_SIZE-1] = 0;
pgpBjC46dohoe.pgp
Description: PGP signature
------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
