On Fri, 2011-04-08 at 17:04 -0700, Rick Jones wrote: > Either I fumbled trying the patch or something else has gone amis > because with a freshly cloned tcpdump, and a new set of sflows I get > output like:
what has happened is I have switched switches and the switch I'm using is not sending the expanded format. so, I'm busily adding support for that... i have something working (*) for both counters and flows and will send it on its way before the end of the week - i am also doing some refactoring to make the code a bit more easy to follow because I kept getting lost in all the switch statements :) rick jones (*) defined as the output looks sane - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
