[flow-tools] Multiple Routers and Tru64
Brandon Saunders
brandon.a.saunders.1@ohio.edu
Wed, 18 Dec 2002 14:07:32 -0500
--==========757203059==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
I have some more information on this issue. When I use the -D option for=20
starting my second collector I get the following:
[root@ginkgo4a genuity]$flow-capture -z6 -E1G -c2 -w/data/netflow/oarnet=20
0/132.235.195.49/9801
This works and collects data
[root@ginkgo4a genuity]$flow-capture -z6 -E1G -D -c2=20
-p/data/netflow/genuity/pid -w/data/netflow/genuity 0/132.235.x.y/9802
flow-capture: ignoring: pid.9802
flow-capture: ignoring: pid.9810
flow-capture: New exporter: time=3D1040238100 src_ip=3D132.235.x.y =
dst_ip=3D0.0.0.0=20
d_version=3D1
flow-capture: bind(0.0.0.0): Address already in use
I tried specifying the local host address, but it didn't change anything. My=20
guess that this is a Tru64 problem. Has anyone seen anything similar to this=20
before?
Thanks,
Brandon Saunders
--On Sunday, December 08, 2002 11:28:35 PM -0500 Mark Fullmer <maf@eng.oar.net> =
wrote:
> Just to follow up again, by crash, did you mean dump core or just stop
> running? If multiple copies of flow-capture are run with the same
> work dir, all but one will quit with a log message complaining
> about not being able to rename a tmp file. This is a feature :)
>
> mark
>
>> On Wed, Dec 04, 2002 at 01:34:58PM -0500, Brandon Saunders wrote:
>> > At a high level I do not understand how collecting flows from multiple
>> > routers works. When doing analysis how can I differentiate routers? I
>> > tried running multiple collectors on different ports, but all of the
>> > instances except one would crash. That would lead me to conclude, that
>> > isn't the right way of doing it.
>
--==========757203059==========
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE+AMd0/JU6IoYGTd0RArd9AKCnRiQ53a/bYygqZWRYeV6OfhDpnQCfV3rS
ew/ASyLjMtMDHpN67pH3NDk=
=UVo3
-----END PGP SIGNATURE-----
--==========757203059==========--