[Flow-tools] killed all flow-capture processes, but can't restart on previously specified port...(?)

[Christian Vo]

thx for the suggestions, I found the culprit process.. turned out an
instance of ntop was running, and I guess it was listening on that port
=(
 
flow collection is working once again =)

________________________________

From: Joe Loiacono [mailto:jloiacon at csc.com] 
Sent: Thursday, December 20, 2007 10:26 AM
To: Christian Vo
Cc: flow-tools at list.splintered.net
Subject: RE: [Flow-tools] killed all flow-capture processes, but can't
restart on previously specified port...(?)



Maybe the port got bound up somehow. 

Can you try a 'netstat -an'? 

If port 2055 is listed then somehow you got to kill it off. You could
try the flow-capture command using a different port and see what
results. 

Joe




"Christian Vo" <cvo at nvidia.com> 

12/20/2007 12:12 PM 

To
Joe Loiacono/CIV/CSC at CSC 
cc
<flow-tools at list.splintered.net>,
<flow-tools-bounces at list.splintered.net> 
Subject
RE: [Flow-tools] killed all flow-capture processes,        but can't
restart on previously specified port...(?)

	




Hi Joe, 
  
This is how I've been running it previously 
  
/usr/local/flow-tools/bin/flow-capture -p /flows/pids/flowcapture1.pid
-w /flows/router1  -E4000M -S3 0/0/2055 
  
after killing this process (kill -TERM...) 
  
I tried to do this: 
/usr/local/flow-tools/bin/flow-capture -p /flows/pids/flowcapture1.pid
-w /flows/all_devices -E4000M -S3 0/0/2055 
  
and it wouldn't start... 

________________________________

From: Joe Loiacono [mailto:jloiacon at csc.com] 
Sent: Thursday, December 20, 2007 5:44 AM
To: Christian Vo
Cc: flow-tools at list.splintered.net;
flow-tools-bounces at list.splintered.net
Subject: Re: [Flow-tools] killed all flow-capture processes, but can't
restart on previously specified port...(?)


Christian, 

Can you show us the syntax of your flow-capture command? 

Thanks, 

Joe



"Christian Vo" <cvo at nvidia.com> 
Sent by: flow-tools-bounces at list.splintered.net 

12/20/2007 05:38 AM 



To
<flow-tools at list.splintered.net> 
cc
Subject
[Flow-tools] killed all flow-capture processes,        but can't restart
on previously specified port...(?)


	





hi, 
I may have missed something in the docs, but I'd really appreciate if
someone can help with the following: 
 
currently running flow-tools.0.68-1, and I was successfully capturing
data. 
stopped my flow-capture processes, with the intention of just exporting
from my network devices to one dest. port. 
 
when I try to restart my flow-capture process I get the following under
/var/log/messages: 
 
2007-12-20T02:10:37-08:00 netmon flow-capture[6574]:
setsockopt(size=4194304)
2007-12-20T02:10:37-08:00 netmon flow-capture[6574]: bind(0.0.0.0):
Address already in use 
 
not sure what to check.. I know I don't have any flow capture processes
remaining... 
google'd the  error message, but no solutions seem to pop up.. 
 
pls help, thx 
 
 


________________________________


This email message is for the sole use of the intended recipient(s) and
may contain confidential information.  Any unauthorized review, use,
disclosure or distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply email and destroy all
copies of the original message. 

________________________________

_______________________________________________
Flow-tools mailing list
flow-tools at splintered.net
http://mailman.splintered.net/mailman/listinfo/flow-tools 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.splintered.net/pipermail/flow-tools/attachments/20071227/3d554dbf/attachment.htm