OK, @Peter: it looks like that if we use NAT64 there are no records in the nfcap-Files for the "X-Src IP Addr" (aka %xsa or %nsa) as these are IPv4 addresses.
Seems that some logic ("there is an 'IPv6 source' and 'X-Dst IP Addr'")
prevents entries of IPv4 addresses (!) into "Dst IP Addr" and "X-Src IP Addr".
But NAT64 is really about that, I think.
Hence in my eyes: a bug.
Am 01.09.2015 um 11:52 schrieb Jens Hektor:
> Am 01.09.2015 um 11:35 schrieb Adrian Popa:
>> Try running your collector with the "-T all" option to capture all
>> extensions. See nfcapd's man page (search for -T). Your %sources hash entry
>> should look like this:
>>
>> '76xx_lab' => { 'port' => '9902', 'col' => '#000000', 'type' =>
>> 'netflow', 'optarg' => '-T all' },
>
> Ah, will try that too.
>
> First of all I had to google and read the mangpage and rebuild
> my nfdunp with "--enable-nsel --enable-nel".
>
> After restarting it was a lot better.
>
> At the moment I am missing just the "%xsa" field though I can
> see it in the packets.
--
Dipl.-Phys. Jens Hektor, Networks
IT Center, RWTH Aachen University
Room 2.04, Wendlingweg 10, 52074 Aachen (Germany)
Phone: +49 241 80 29206 - Fax: +49 241 80 22100
http://www.itc.rwth-aachen.de - hek...@itc.rwth-aachen.de
smime.p7s
Description: S/MIME Cryptographic Signature
------------------------------------------------------------------------------ Monitor Your Dynamic Infrastructure at Any Scale With Datadog! Get real-time metrics from all of your servers, apps and tools in one place. SourceForge users - Click here to start your Free Trial of Datadog now! http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140
_______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
