[prev in list] [next in list] [prev in thread] [next in thread] 

List:       flowscan
Subject:    Re: flowscan and ipcad
From:       "Leigh Sharpe" <lsharpe () pacificwireless ! com ! au>
Date:       2005-07-06 0:11:04
Message-ID: 001b01c581bf$387670b0$1a0110ac () pacwire ! local
[Download RAW message or body]

By the look of it, yur Linux box is producing netflow exports OK, but for
some reason flowscan is not recognising them as being 'of interest'.
Depending on how your Linux box and flowscan configuration are set up, it
could be because you are using different IfIndex on the router, but your
flowscan configuration is looking at the old router's IfIndex to determine
inbound/outbound.
Check all of your flowscan configurations for anything that may have chenged
on the new router.


----- Original Message ----- 
From: "Francesco Usseglio Gaudi" <cecco@ica-net.it>
To: <flowscan@net.doit.wisc.edu>
Sent: Wednesday, July 06, 2005 1:52 AM
Subject: flowscan and ipcad


> Hi,
> I was using a cisco 7120 with netflow, flow-capture and flowscan:
> everything was ok.
> Some days ago my cisco router died so i replace it with a linux server
> (doing full bgp routing table with quagga). Today I tried to use ipcad
> (netflow for linux) and sending the flow to the previous linux running
> flow-capture and flowscan. flow-capture seems to work as it's creating
> its file (ft-v05....). flowscan reads the files but it says :
>
> 2005/07/05 17:50:23 working on file ft-v05.2005-07-05.174500+0200...
> 2005/07/05 17:50:24 flowscan-1.020 CampusIO: Cflow::find took  1
> wallclock secs ( 0.54 usr +  0.00 sys =  0.54 CPU) for 1391960 flow file
> bytes, flow hit ratio: 0/21748
> 2005/07/05 17:50:24 flowscan-1.020 CampusIO: report took  0 wallclock
> secs ( 0.04 usr +  0.01 sys =  0.05 CPU)
>
> As you can see the hit ratio is 0/21748, so no graphs.
>
> What can be the problem?
>
> Thank You
> Francesco
>
>
> --
> Help        mailto:majordomo@net.doit.wisc.edu and say "help" in message
body
> Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
> "unsubscribe flowscan" in message body
> Archive     http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
>


--
Help        mailto:majordomo@net.doit.wisc.edu and say "help" in message body
Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
"unsubscribe flowscan" in message body
Archive     http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
[prev in list] [next in list] [prev in thread] [next in thread]