[flow-tools] Multiple Routers and Tru64

[Mark Fullmer]

Is it possible Tru64 imposes a resource limit on the number of UDP ports
a user can listen on?

What happens if you try to invoke two copies of flow-receive on different
ports?

The other curious thing is the dst_ip=0.0.0.0.  The IP_RECVDSTADDR or
IP_PKTINFO method to obtain the destination IP is not working.  Make sure
that setsockopt() is not getting called, it's not the most portable code
(different "standards") and has caused problems on one other OS.

mark

On Wed, Dec 18, 2002 at 02:07:32PM -0500, Brandon Saunders wrote:
> I have some more information on this issue.  When I use the -D option for 
> starting my second collector I get the following:
> 
> [root@ginkgo4a genuity]$flow-capture -z6 -E1G -c2 -w/data/netflow/oarnet 
> 0/132.235.195.49/9801
> 	This works and collects data
> 
> [root@ginkgo4a genuity]$flow-capture -z6 -E1G -D -c2 
> -p/data/netflow/genuity/pid -w/data/netflow/genuity 0/132.235.x.y/9802
> flow-capture: ignoring: pid.9802
> flow-capture: ignoring: pid.9810
> flow-capture: New exporter: time=1040238100 src_ip=132.235.x.y dst_ip=0.0.0.0 
> d_version=1
> flow-capture: bind(0.0.0.0): Address already in use
> 
> 
> I tried specifying the local host address, but it didn't change anything.  My 
> guess that this is a Tru64 problem.  Has anyone seen anything similar to this 
> before?
> 
> Thanks,
> 
> Brandon Saunders
> 
> --On Sunday, December 08, 2002 11:28:35 PM -0500 Mark Fullmer <maf@eng.oar.net> 
> wrote:
> 
> > Just to follow up again, by crash, did you mean dump core or just stop
> > running?  If multiple copies of flow-capture are run with the same
> > work dir, all but one will quit with a log message complaining
> > about not being able to rename a tmp file.  This is a feature :)
> >
> > mark
> >
> >> On Wed, Dec 04, 2002 at 01:34:58PM -0500, Brandon Saunders wrote:
> >> > At a high level I do not understand how collecting flows from multiple
> >> > routers works.  When doing analysis how can I differentiate routers?  I
> >> > tried running multiple collectors on different ports,  but all of the
> >> > instances except one would crash.  That would lead me to conclude, that
> >> > isn't the right way of doing it.
> >
>