[Flow-tools] flow-fanout error

[Joe Loiacono]

Actually the lost counts really aren't that high. What you're seeing is 
that (from the first line) flow-fanout was expecting UDP packet numbered 
7959254 but received UDP packet numbered 5834414, so teh difference is 
5834414 - 7959254 = -2124840. This gets represented by 2**32 - 2124840 = 
4292842455.

What is probably happening is you are exporting from two different sources 
and flow-fanout is confusing the data streams. Sometimes this can happen 
from a single device (e.g., 6509) where the switch and MLS exporters are 
represented with different IP addresses.

There is a more detailed discussion of this on the mailing list archives.

Joe





"Koski, David" <dkoski at umich.edu> 
Sent by: flow-tools-bounces at list.splintered.net
11/07/2008 08:26 AM

To
"flow-tools at list.splintered.net" <flow-tools at list.splintered.net>
cc

Subject
[Flow-tools] flow-fanout error






We just brought a new RHEL5 x64 box online and are seeing spurious errors 
to the logs where the lost count is very high.  Has anyone seen this 
before?  Is there any patch for it (We are running the googlecode fork, 
latest stable version):
 
Nov  7 08:24:30 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=7959254 
received=5834414 lost=4292842455
Nov  7 08:24:30 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=5834906 
received=7959254 lost=2124348
Nov  7 08:24:30 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=7960275 
received=5834906 lost=4292841926
Nov  7 08:24:31 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=5838510 
received=7960275 lost=2121765
Nov  7 08:24:31 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=7960432 
received=5838510 lost=4292845373
Nov  7 08:24:33 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=1683581 
received=2854 lost=4293286568
Nov  7 08:24:34 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=2863 
received=1683581 lost=1680718
Nov  7 08:24:35 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=1685635 
received=2863 lost=4293284523
Nov  7 08:24:36 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=2877 
received=1685635 lost=1682758
Nov  7 08:24:36 bin-a flow-fanout[18249]: ftpdu_seq_check(): 
src_ip=127.0.0.1 dst_ip=127.0.0.1 d_version=5 expecting=1686133 
received=2877 lost=4293284039
 
                Thanks
 
                                David
_______________________________________________
Flow-tools mailing list
flow-tools at splintered.net
http://mailman.splintered.net/mailman/listinfo/flow-tools
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.splintered.net/pipermail/flow-tools/attachments/20081107/f8010aec/attachment-0001.htm