Munroe,
please send me a pcap with incoming flows (port 5556) and templates and
I will let you know. I believe Gigamon is not sending all the necessary
info, at least on standard fields
Luca
On 10/14/2015 04:02 PM, Munroe Sollog wrote:
> I am running nprobe like so:
>
> nprobe --zmq tcp://*:5556 --collector-port 2055 -i none -n none -b2
>
>
> Using version:
> # nprobe -v
>
> Welcome to nProbe v.7.2.150925 (r4540) for x86_64-unknown-linux-gnu
> with native PF_RING acceleration.
> Copyright 2002-15 ntop.org
>
> Build OS: Ubuntu 14.04.2 LTS
> SystemID: 3BDC395C5905A1EF
> License: Invalid nProbe license (/etc/nprobe.license) [Missing
> license file]
>
> nProbe is subject to the terms and conditions defined in
> the LICENSE and EULA files that are part of this package.
>
> nProbe also contains third party code:
> Radix tree code - (C) The Regents of the University of Michigan
> ("The Regents") and Merit Network, Inc.
> sFlow collector - (C) InMon Inc.
>
>
> In debug mode I get:
>
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60027]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60027]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60027]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60027]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60027]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60027]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60027]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
> 05/Oct/2015 12:49:54 [collect.c:365] Received flow with invalid count
> [sentPkts: 0][sentOctets:0]:
> discarded [num_flows: 60028]
>
> Which leads me to believe the template isn't being sent with the netflow
> data, but I did a packet
> capture and it looks like it is there. I did a packet capture and it does
> infact look like the
> gigamon is sending the template along with the data. (I can provide this upon
> request)
>
>
> Any help would be appreciated. Thanks.
>
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
