Do the following lines provide any clues:<br><br>Jan 8 17:40:46 Monitor02 flow-capture[12371]: ftpdu version not set.<br>Jan 8 17:40:46 Monitor02 flow-capture[12371]: ftpdu_verify(): src_ip=192.168.222.1 failed.<br><br><br>
Kirk<br><br><div class="gmail_quote">On Fri, Jan 8, 2010 at 11:19 AM, Ed Ravin <span dir="ltr"><<a href="mailto:eravin@panix.com">eravin@panix.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">On Fri, Jan 08, 2010 at 10:33:07AM -0600, Kirk Olson wrote:<br>
> flow-capture is running and tcpdump reports incoming udp packets but<br>
> files are not being written in the directory specified. I am using the<br>
> following command to start the capture:<br>
><br>
> flow-capture -w /flows/mkflows 0/0/9800 -S5 -n287<br>
<br>
</div>Put the "0/0/9800" last on the command line, after all the hyphenated<br>
options.<br>
<br>
Make sure the /flows/mkflows directory exists.<br>
<br>
Also, check with tcpdump that the incoming UDP packets are destined for<br>
port 9800.<br>
<br>
Check the syslogs for any errors from flow-capture.<br>
<br>
Use "lsof -p <pid-of-flow-capture>" to make sure flow-capture is listening<br>
to the right UDP port.<br>
<br>
If all else fails, use "strace -p <pid-of-flow-capture>" to trace through<br>
what it's doing or not doing.<br>
</blockquote></div><br>