[Flow-tools] Using flow-fanout with different interfaces

[Joe Loiacono]

Kai,

This might help:

http://ensight.eos.nasa.gov/FlowViewer/faq.html#27

Joe



"Zemke, Kai" <Kai.Zemke at smartnet.de> 
Sent by: flow-tools-bounces at list.splintered.net
01/06/2009 10:44 AM

To
<flow-tools at list.splintered.net>
cc

Subject
[Flow-tools] Using flow-fanout with different interfaces






Hi,
 
i have created a scenario in which i receive the netflow streams from 
three different routers. These three streams reach my system all on the 
same interface. On this interface the streams get caught by flow-fanout 
and I distribute them to the loopback interface on two difeerent ports. 
This is working great so far. 
 
But I Added a new interface to the system on which I wanted to receive 
streams for testing. Via tcpdump I can see packages reaching this 
interface on the correct port. But when I try to distribute this stream 
via flow-fanout, nothing happens. The stream unlike the others is not 
duplicated to the two ports on the loopback interface.
 
Flow-fanout is called like this for the working interface
flow-fanout hostadress/exporteraddress/9600 0/0/9610 0/0/9620
flow-fanout hostadress/exporteraddress/9700 0/0/9710 0/0/9720
flow-fanout hostadress/exporteraddress/9800 0/0/9810 0/0/9820
 
For the not working interface I called it like this:
flow-fanout 10.1.1.121/exporteradress/9900 0/0/9910
 
I don’t understand why the last example doesn’t work. Anyone who can give 
me a hint what I am doing wrong or knows that I make mistake here? Any 
help is highly appreciated.
 
Mit freundlichen Grüßen
Kai Zemke
 
=========================================================== 
smartnet Online Service GmbH, Schnackenburgallee 177, 22525 Hamburg 
=========================================================== 
Geschäftsführer: Christian Suding, Claus Masch 
Ust.IdNr.:DE191136350
Handelsregister HRB 66463 
Steuernummer: FA: Hamburg 54/855/01047
Fon: +49 (0) 40 5540-0
Fax: +49 (0) 40 5540-1040
kai.zemke at smartnet.de
Weitere Informationen siehe: http://www.smartnet.de
=========================================================== 
 
Hinweis:
Diese Email kann vertrauliche und/oder rechtlich geschützte 
Informationen enthalten. Wenn Sie nicht der beabsichtigte 
Empfänger sind oder diese Email irrtümlich erhalten haben, 
informieren Sie bitte sofort den Absender telefonisch oder 
per Email und löschen Sie diese Email aus Ihrem System. 
Das unerlaubte Kopieren, sowie die unbefugte Weitergabe 
dieser Email ist nicht gestattet.Wir haften nicht für die 
Unversehrtheit von Emails, nachdem sie unseren Einfluss-
Bereich verlassen haben.
 
IMPORTANT: The contents of this email and any attachments are 
confidential. They are intended for the named recipient(s) only.
If you have received this email in error, please notify the system manager 
or the sender immediately and do not disclose the contents to anyone or 
make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. 
*** _______________________________________________
Flow-tools mailing list
flow-tools at splintered.net
http://mailman.splintered.net/mailman/listinfo/flow-tools

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.splintered.net/pipermail/flow-tools/attachments/20090106/8b44350a/attachment.htm