Hi Bernd, If i get it correctly, you should be referring to the big 1073741823 and 2147483648 values in your SQL table. According to the sFlow (v5) specifications, these values are perfectly valid:
1073741823 => 0x3FFFFFFF: "[ ... ] this is used in describing traffic which is not bridged, routed, or otherwise sent through the device being monitored by the agent, but which rather originates or terminates in the device itself. In the input field, this value is used to indicate packets for which the origin was the device itself (e.g. a RIP request packet sent by the device, if it is acting as an IP router). In the output field, this value is used to indicate packets for which the destination was the device itself (e.g. a RIP response packet (whether unicast or not) received by the device, if it is acting as an IP router)." 2147483648 => 0x80000000: "indicates a packet sent to an unknown number of interfaces greater than 1." - broadcast or multicast come to mind. There are some further codes/information passed through the interface fields; i'd like to point you to [1] for a more complete reference - even though it says new codes might be issued over the time. Of course, with tagging you drive what you expect to see; while dumping information straight from sFlow into a primitive catches such additional things you either don't know about or won't expect to see. Cheers, Paolo [1] http://www.sflow.org/SFLOW-DATAGRAM5.txt On Tue, Apr 27, 2010 at 12:46:44PM +0200, Bernd Boom wrote: > Hi everybody, > > is use the sflow collector and want to collect sflow data depending > on the inteface information which should be possible since version 0.12.1. > > The importat columns are in_iface and out_iface as you can see in the > aggregate part. > > --------------------- > aggregate: tag,tag2,in_iface, > out_iface,flows,tcpflags,vlan,tag,src_host,dst_hos > t,src_port,dst_port,proto,src_mac,dst_mac,tos > --------------------- > > The problem is that i receive the following (sometimes wrong) interface > information, as you can seen from the database output. > > [ ... ] > > The correct interfaces are for example agent_id=3 23 and 24. > > I compile with --64bit and without this option, but with the same result. > > Are there any ideas why the interface information is sometimes "wrong" > > Although it is to my infomation not possible that there are in and > out interface information in the same flow informatione (mostly the switches > only support only (in-flowaccounting) as this switches! > > The version 0.12.0 works correct with these foundry switches with > pretagging the interface information! > > many thanks > > Bernd Boom _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
