From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of William Wollman
Sent: Wednesday, August 10, 2005 10:16 AM
To: [email protected]
Subject: [Ntop] ntop and netflow v9
I am getting the following error messages when using cisco's netflow v9 with ntop.... any ideas on what may be causing this? TIA, Bill W.
Wed 10 Aug 2005 10:44:19 AM EDT THREADMGMT: netFlow thread(-241136720) started
Wed 10 Aug 2005 10:44:54 AM EDT **WARNING** NETFLOW: Truncated network size(device NetFlow-device.2) to 1024 hosts(real netmask 255.255.0.0).
Read docs/FAQ on that one...
Wed 10 Aug 2005 10:53:31 AM EDT **WARNING** Template 23 has wrong size [actual=50492/expected=584]: skipped
Wed 10 Aug 2005 11:03:32 AM EDT **WARNING** Template 33 has wrong size [actual=50492/expected=11936]: skipped
Code for those is in netflowPluginc. around 952ff. You might try enabling DEBUG_FLOWS in the source, but that will generate a lot of output. So it might be better to add info to the error message:
if(len
> template.flowsetLen)
{
static u_short lastBadTemplate = 0;
if(template.templateId != lastBadTemplate)
{
if(lastBadTemplate == 0)
{
traceEvent(CONST_TRACE_INFO, "Found Template [displ=%d]",
displ);
traceEvent(CONST_TRACE_INFO, "Found Template Type: %d",
isOptionTemplate);
}
traceEvent(CONST_TRACE_WARNING, "Template %d fields: %d has wrong size
[actual=%d/expected=%d]:
skipped",
template.fieldCount, template.templateId, len,
template.flowsetLen);
for(fieldId=0; (fieldId < template.fieldCount); fieldId++)
{
V9FlowSet *set =
(V9FlowSet*)&buffer[displ+sizeof(V9Template)+fieldId*sizeof(V9FlowSet)];
traceEvent(CONST_TRACE_INFO, "[%d] fieldLen=%d", 1+fieldId,
htons(set->flowsetLen));
}
lastBadTemplate =
template.templateId;
}
myGlobals.device[deviceId].netflowGlobals->numNetFlowsV9BadTemplRcvd++;
-----Burton
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
