Hello Steve, On Tue, Mar 29, 2005 at 05:29:03PM +0100, Steve Wright wrote:
> Running pmacct-0.8.2, nfacctd to MySQL my ip_proto field I see a large GRE > (ESP) flow [1] being reported as ipv6-c in the table. > > [1] sh ip cache flow displays: > Gi0/0 xxx.xxx.xxx.209 Gi0/1 xxx.xxx.xxx.138 32 13C5 A2BC > 41K The protocol here should be that 32, which should be read 0x32 . 32 hexadecimal -> 50 decimal . If you give a quick lookup to your '/etc/protocols' it should contain somewhere the following line: ipv6-crypt 50 IPv6-Crypt # Encryption Header for IPv6 The 'ipv6-c' is the cutted version of 'IPv6-Crypt'. Moreover, pmacct does not rely on the system '/etc/protocol' but on an 'hardcoded' one contained into the 'pmacct-data.h' header file. If you wish to change the equivalence for protocol '50', feel free to edit that file. The protocol name is then cutted to first six letters by the MySQL field definition: 'ip_proto CHAR(6) NOT NULL'. Cheers, Paolo
