On Feb 18, 2011, at 2:29 AM, brad dreisbach wrote: > > On Feb 18, 2011, at 1:43 AM, Peter Haag wrote: > >> On 2/17/11 20:03, brad dreisbach wrote: >>> does anyone know what this error means and how to fix it? >>> >>> nfcapd[9729]: [ID 351010 daemon.error] Process_v9: Unexpected SAMPLER ID >>> field length: 2 >> >> According to the v9 spec from CISCO as well as rfc3954 specifies the v9 >> field FLOW_SAMPLER_ID 48 as 1 byte. That's what >> nfdump implements so far. If anybody has some other documentation, please >> let me know. I'll check, what I can find out. >> What router hardware/software is exporting these floes? > > It's a Cisco ASR9000 running IOS-XR 4.0.1.
I looked into this a bit further and collected a raw netflow packet using tcpdump and analyzed it in wireshark. It looks like they are setting the FlowSet ID value to 260. I am also told that XR sends netflow10/ipfix IDs but in netflowv9 format. > >> >> Cheers >> >> - Peter >> >>> >>> I set the log level to debug but its not providing any useful information. >>> >>> thanks, >>> -b >>> ------------------------------------------------------------------------------ >>> The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE: >>> Pinpoint memory and threading errors before they happen. >>> Find and fix more than 250 security defects in the development cycle. >>> Locate bottlenecks in serial and parallel code that limit performance. >>> http://p.sf.net/sfu/intel-dev2devfeb >>> _______________________________________________ >>> Nfsen-discuss mailing list >>> Nfsen-discuss@lists.sourceforge.net >>> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > > > ------------------------------------------------------------------------------ > The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE: > Pinpoint memory and threading errors before they happen. > Find and fix more than 250 security defects in the development cycle. > Locate bottlenecks in serial and parallel code that limit performance. > http://p.sf.net/sfu/intel-dev2devfeb > _______________________________________________ > Nfsen-discuss mailing list > Nfsen-discuss@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss ------------------------------------------------------------------------------ The ultimate all-in-one performance toolkit: Intel(R) Parallel Studio XE: Pinpoint memory and threading errors before they happen. Find and fix more than 250 security defects in the development cycle. Locate bottlenecks in serial and parallel code that limit performance. http://p.sf.net/sfu/intel-dev2devfeb _______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
