[netsa-tools-discuss] SiLK rwflowpack IPv6 listening trouble
Jay Ford
jnford at uiowa.net
Wed Oct 25 11:18:30 EDT 2017
I'm running SiLK 3.16.0 on a Debian "stretch" Linux system with an IPFIX
probe defined to listen via IPv6 configured in sensor.conf like this:
probe rtr-ipfix ipfix
listen-as-host 2001:db8:ff::7
listen-on-port 2001
protocol udp
accept-from-host 2001:db8:ff::7 2001:db8::7
end probe
That was working fine before a recent system upgrade, after which rwflowpack
fails to start, logging this:
rwflowpack[902]: Creating IPFIX Reader for probe 'rtr-ipfix' on [2001:db8:ff::7]:2001
rwflowpack[902]: 'rtr-ipfix': error looking up address 2001:db8:ff::7:2001: Address family for hostname not supported
rwflowpack[902]: Could not create IPFIX Reader for 'rtr-ipfix' on [2001:db8:ff::7]:2001
rwflowpack[902]: Unable to start flow processor #1 for IPFIX/NetFlowV9 Reader
The crux of the problem is the concatenation of the address & port (without
square brackets required in such literal syntax) resulting in the bogus:
2001:db8:ff::7:2001
Rolling back some Perl packages:
package broken version working version
________________ _______________ _______________
libperl5.24 5.24.1-3+deb9u1 5.24.1-3+deb9u2
perl 5.24.1-3+deb9u1 5.24.1-3+deb9u2
perl-base 5.24.1-3+deb9u1 5.24.1-3+deb9u2
perl-modules-5.24 5.24.1-3+deb9u1 5.24.1-3+deb9u2
lets it work again, but given the log messages I suspect a SiLK problem more
than a Perl problem, but that's just a guess.
Does anybody have an idea where the problem might be & how to fix it?
________________________________________________________________________
Jay Ford, Network Engineering Group, Information Technology Services
University of Iowa, Iowa City, IA 52242
email: jnford at uiowa.net, phone: 319-335-5555
More information about the netsa-tools-discuss
mailing list