On Aug 3, 2011 12:33 PM, "ash kumar" <[email protected]> wrote: > > Yes. srcip is being populated correctly. In addition the dstip is getting a uniform value of 32767 which tells me there is something odd going on. >
That's not what I meant. I meant is the dstip value being inserted into the srcip field? Find a log message that decodes a dstip and not a srcip, and check the db. > I have not tried disabling local_decoder and checking as yet though.
