<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16587" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left>
<P><FONT size=2>netstat -an | grep 2055<SPAN class=137293709-21122007> gives the
following</SPAN></FONT></P>
<P><FONT size=2>udp 0 0 0.0.0.0:2055 0.0.0.0:*</FONT></P>
<P><FONT face=Arial><FONT size=2><SPAN class=137293709-21122007>btw t</SPAN>he
server is running SuSE 10.2<SPAN class=137293709-21122007>; I noticed the same
issue if I start a capture session , kill it and try to restart.. the
flow-capture wouldn't restart; the only thing I could do was increment the
listening port... </SPAN></FONT></FONT></P></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Joe Loiacono [mailto:jloiacon@csc.com]
<BR><B>Sent:</B> Thursday, December 20, 2007 10:26 AM<BR><B>To:</B> Christian
Vo<BR><B>Cc:</B> flow-tools@list.splintered.net<BR><B>Subject:</B> RE:
[Flow-tools] killed all flow-capture processes, but can't restart on previously
specified port...(?)<BR></FONT><BR></DIV>
<DIV></DIV><BR><FONT face=sans-serif size=2>Maybe the port got bound up
somehow.</FONT> <BR><BR><FONT face=sans-serif size=2>Can you try a 'netstat
-an'?</FONT> <BR><BR><FONT face=sans-serif size=2>If port 2055 is listed then
somehow you got to kill it off. You could try the flow-capture command using a
different port and see what results.</FONT> <BR><BR><FONT face=sans-serif
size=2>Joe<BR></FONT><BR><BR><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="40%"><FONT face=sans-serif size=1><B>"Christian Vo"
<cvo@nvidia.com></B> </FONT>
<P><FONT face=sans-serif size=1>12/20/2007 12:12 PM</FONT> </P>
<TD width="59%">
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>To</FONT></DIV>
<TD><FONT face=sans-serif size=1>Joe Loiacono/CIV/CSC@CSC</FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>cc</FONT></DIV>
<TD><FONT face=sans-serif
size=1><flow-tools@list.splintered.net>,
<flow-tools-bounces@list.splintered.net></FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>Subject</FONT></DIV>
<TD><FONT face=sans-serif size=1>RE: [Flow-tools] killed all
flow-capture processes, but can't restart
on previously specified port...(?)</FONT></TR></TBODY></TABLE><BR>
<TABLE>
<TBODY>
<TR vAlign=top>
<TD>
<TD></TR></TBODY></TABLE><BR></TR></TBODY></TABLE><BR><BR><BR><FONT face=Arial
color=blue size=2>Hi Joe,</FONT> <BR><FONT size=3> </FONT> <BR><FONT
face=Arial color=blue size=2>This is how I've been running it previously</FONT>
<BR><FONT size=3> </FONT> <BR><FONT face=Arial color=blue
size=2>/usr/local/flow-tools/bin/flow-capture -p /flows/pids/flowcapture1.pid -w
/flows/router1 -E4000M -S3 0/0/2055</FONT> <BR><FONT size=3> </FONT>
<BR><FONT face=Arial color=blue size=2>after killing this process (kill
-TERM...)</FONT> <BR><FONT size=3> </FONT> <BR><FONT face=Arial color=blue
size=2>I tried to do this:</FONT> <BR><FONT face=Arial color=blue
size=2>/usr/local/flow-tools/bin/flow-capture -p /flows/pids/flowcapture1.pid -w
/flows/all_devices -E4000M -S3 0/0/2055</FONT> <BR><FONT size=3> </FONT>
<BR><FONT face=Arial color=blue size=2>and it wouldn't start...</FONT> <BR>
<HR>
<FONT face=Tahoma size=2><B>From:</B> Joe Loiacono [mailto:jloiacon@csc.com]
<B><BR>Sent:</B> Thursday, December 20, 2007 5:44 AM<B><BR>To:</B> Christian
Vo<B><BR>Cc:</B> flow-tools@list.splintered.net;
flow-tools-bounces@list.splintered.net<B><BR>Subject:</B> Re: [Flow-tools]
killed all flow-capture processes, but can't restart on previously specified
port...(?)</FONT><FONT size=3><BR></FONT><BR><FONT face=sans-serif
size=2><BR>Christian,</FONT><FONT size=3> <BR></FONT><FONT face=sans-serif
size=2><BR>Can you show us the syntax of your flow-capture command?</FONT><FONT
size=3> <BR></FONT><FONT face=sans-serif size=2><BR>Thanks,</FONT><FONT size=3>
<BR></FONT><FONT face=sans-serif size=2><BR>Joe</FONT><FONT
size=3><BR><BR><BR></FONT>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="31%"><FONT face=sans-serif size=1><B>"Christian Vo"
<cvo@nvidia.com></B> <BR>Sent by:
flow-tools-bounces@list.splintered.net</FONT><FONT size=3> </FONT>
<P><FONT face=sans-serif size=1>12/20/2007 05:38 AM</FONT><FONT size=3>
</FONT></P>
<TD width="68%"><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="7%">
<DIV align=right><FONT face=sans-serif size=1>To</FONT></DIV>
<TD width="92%"><FONT face=sans-serif
size=1><flow-tools@list.splintered.net></FONT><FONT size=3>
</FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>cc</FONT></DIV>
<TD>
<TR vAlign=top>
<TD>
<DIV align=right><FONT face=sans-serif size=1>Subject</FONT></DIV>
<TD><FONT face=sans-serif size=1>[Flow-tools] killed all
flow-capture processes, but can't restart
on previously specified port...(?)</FONT></TR></TBODY></TABLE><BR><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="50%">
<TD width="50%"></TR></TBODY></TABLE><BR></TR></TBODY></TABLE><BR><FONT
size=3><BR><BR></FONT><FONT face=Arial size=2><BR>hi, <BR>I may have missed
something in the docs, but I'd really appreciate if someone can help with the
following:</FONT><FONT size=3> <BR> </FONT><FONT face=Arial
size=2><BR>currently running flow-tools.0.68-1, and I was successfully capturing
data.</FONT><FONT size=3> </FONT><FONT face=Arial size=2><BR>stopped my
flow-capture processes, with the intention of just exporting from my network
devices to one dest. port.</FONT><FONT size=3> <BR> </FONT><FONT face=Arial
size=2><BR>when I try to restart my flow-capture process I get the following
under /var/log/messages:</FONT><FONT size=3> <BR> </FONT><FONT face=Arial
size=2><BR>2007-12-20T02:10:37-08:00 netmon flow-capture[6574]:
setsockopt(size=4194304)<BR>2007-12-20T02:10:37-08:00 netmon flow-capture[6574]:
bind(0.0.0.0): Address already in use</FONT><FONT size=3> <BR> </FONT><FONT
face=Arial size=2><BR>not sure what to check.. I know I don't have any flow
capture processes remaining... <BR>google'd the error message, but no
solutions seem to pop up..</FONT><FONT size=3> <BR> </FONT><FONT face=Arial
size=2><BR>pls help, thx</FONT><FONT size=3> <BR> </FONT><FONT face=Arial
size=2><BR></FONT><FONT size=3> <BR><BR></FONT>
<HR>
<FONT size=3><BR>This email message is for the sole use of the intended
recipient(s) and may contain confidential information. Any unauthorized
review, use, disclosure or distribution is prohibited. If you are not the
intended recipient, please contact the sender by reply email and destroy all
copies of the original message. <BR></FONT>
<HR>
<FONT size=2><TT>_______________________________________________<BR>Flow-tools
mailing
list<BR>flow-tools@splintered.net<BR>http://mailman.splintered.net/mailman/listinfo/flow-tools</TT></FONT><FONT
size=3> </FONT><BR></BODY></HTML>