[netsa-tools-discuss] I found problem with rwflowpack show "NetFlow V9 sequence number mismatch for domain" in log.
Waranon Piasri
waranon.pia at gmail.com
Thu Apr 16 02:23:01 EDT 2015
*Dear All,*
Hello, I have SiLK v. 3.10.1 and libfixbuf v.1.6.1. When I
run rwflowpack command with
"rwflowpack --no-daemon --root-directory=/var/lib/flows/silk_device_1/
--site-config-file=/etc/sysconfig/silk.conf
--sensor-configuration=/etc/sysconfig/sensor.conf
--log-directory=/var/log/ --pack-interfaces --sensor-name=S0'"
and I found some error in as below
Apr 15 05:16:21 BCIRENFLWP01 rwflowpack[8684]: 'rwflowpack' '--no-daemon'
'--root-directory=/var/lib/flows/silk_device_1/'
'--site-config-file=/etc/sysconfig/silk.conf'
'--sensor-configuration=/etc/sysconfig/sensor.conf'
'--log-directory=/var/log/' '--pack-interfaces' '--sensor-name=S0'
Apr 15 05:16:21 BCIRENFLWP01 rwflowpack[8684]: Using packing logic from
/usr/lib64/silk/packlogic-twoway.so
Apr 15 05:16:21 BCIRENFLWP01 rwflowpack[8684]: Creating stream cache
Apr 15 05:16:21 BCIRENFLWP01 rwflowpack[8684]: Creating NetFlowV9 Reader
for probe 'S0' on *:9996
Apr 15 05:16:21 BCIRENFLWP01 rwflowpack[8684]: Starting flush timer
*Apr 15 05:16:37 BCIRENFLWP01 rwflowpack[8684]: 'S0': accepted connection
from 10.20.144.102:46971 <http://10.20.144.102:46971>, domain 0x0001*
*Apr 15 05:16:37 BCIRENFLWP01 rwflowpack[8684]: NetFlow V9 sequence number
mismatch for domain 0x0001, expecting 0x0000 received 0x2740*
*Apr 15 05:16:40 BCIRENFLWP01 rwflowpack[8684]: 'S0': accepted connection
from 10.20.144.101:38670 <http://10.20.144.101:38670>, domain 0x0001*
*Apr 15 05:16:40 BCIRENFLWP01 rwflowpack[8684]: NetFlow V9 sequence number
mismatch for domain 0x0001, expecting 0x0000 received 0x204d*
Apr 15 05:18:21 BCIRENFLWP01 rwflowpack[8684]: 'S0': forward 0, reverse 0,
ignored 0, nf9: missing-pkts 0
Apr 15 05:20:21 BCIRENFLWP01 rwflowpack[8684]: Flushing files after 120
seconds.
Please suggest me fix this problem.
*Best regards,*
Waranon Piasri
-------------- next part --------------
HTML attachment scrubbed and removed
More information about the netsa-tools-discuss
mailing list