Re: converting sflow into netflow using sflowtool does not

James,

Another suggestion is to run "sflowtool -l" to dump the output in
ASCII and confirm that you are getting flow-samples with IPv4
addresses (not just counter-samples, or other protocols). You may
need to reduce the sampling-rate setting that you are using on the
switch if there is not enough traffic.

(You may also want to use the "-S" option so that the source address
of each netflow packet is spoofed to look like it came straight from
the switch).

regards,
neil

On Sep 14, 2006, at 7:42 AM, clau_cdn clau_cdn wrote:

> Neil,
>
> Thank you for your reply. I did use the -i in tcpdump and there was
> definetly no traffic being forwarded. I will try re-compiling from
> source. Thanks!
>
> James
>
>
>> From: Neil McKee <neil.mckee@inmon.com>
>> To: "clau_cdn clau_cdn" <clau_cdn@msn.com>
>> CC: traffic-management@inmon.com
>> Subject: Re: [traffic-management] converting sflow into netflow
>> using sflowtool does not work
>> Date: Wed, 13 Sep 2006 17:43:40 -0700
>>
>> James,
>>
>> There are no limitations about using localhost. This should work.
>>
>> First thought: did you include "-i lo" in the tcpdump command
>> line? Something like "tcpdump -i lo udp port 2055" should do it.
>>
>> Second thought: you could download the sources, compile with -
>> g, and run using gdb(1). Then you can add print statements,
>> set breakpoints and single-step to make sure it is working. One
>> of the perks of open-source :)
>>
>> regards,
>> neil
>>
>>
>> On Sep 13, 2006, at 4:23 PM, clau_cdn clau_cdn wrote:
>>
>>> I am trying to convert the sFlow datagrams into NetFlow and have
>>> a little problem. The agent is an HP ProCurve switch, the agent
>>> is enabled, configured and the datagrams are arriving at the
>>> collector (a linux box). On the collector (linux box) I do this:
>>>
>>> #./sflowtool -c localhost -d 2055
>>>
>>> I want that the sFlow traffic to be converted and forwarded to
>>> the same machine (localhost) to port 2055. Using tcpdump I can
>>> confirm that there is nothing converted/sent to my 2055 port. I
>>> can see that all the sFlow traffic arrives successfully from the
>>> agent and so far I can isolate this problem at the sflowtool
>>> processing phase. Is this a limitation of sflowtool aka I have
>>> to use a separate machine for collecting than the one which does
>>> the forwarding?
>>>
>>> Any input would be greately appreciated, thanks!
>>>
>>> James
>>>
>>> _________________________________________________________________
>>> Buy what you want when you want it on Sympatico / MSN Shopping
>>> http://shopping.sympatico.msn.ca/content/shp/?
>>> ctId=2,ptnrid=176,ptnrdata=081805
>>
>>
>>
>> ----------
>> Neil McKee
>> http://www.inmon.com
>
> _________________________________________________________________
> Dont waste time standing in linetry shopping online. Visit
> Sympatico / MSN Shopping today! http://shopping.sympatico.msn.ca
Received on Thu Sep 14 08:18:50 2006