tcpdump mailing list archives
Re: [PATCH] print-sflow.c - actually print more
From: Rick Jones <rick.jones2 () hp com>
Date: Fri, 08 Apr 2011 17:04:50 -0700
Either I fumbled trying the patch or something else has gone amis because with a freshly cloned tcpdump, and a new set of sflows I get output like: raj@tardy:~/tcpdump$ ./tcpdump -r /tmp/sflow.pcap -vvv reading from file /tmp/sflow.pcap, link-type EN10MB (Ethernet) 16:45:18.468863 IP (tos 0x0, ttl 64, id 48091, offset 0, flags [none], proto UDP (17), length 1232) the-switch.54321 > z400.sflow: [udp sum ok] sFlowv5, IPv4 agent the-switch, agent-id 0, seqnum 5908, uptime 2294190, samples 6, length 1204 flow sample (1), length 208, flow sample (1), length 148, flow sample (1), length 208, flow sample (1), length 148, flow sample (1), length 208, flow sample (1), length 208, ... 16:47:41.409631 IP (tos 0x0, ttl 64, id 49088, offset 0, flags [none], proto UDP (17), length 1348) the-switch.54321 > z400.sflow: [udp sum ok] sFlowv5, IPv4 agent the-switch, agent-id 0, seqnum 6903, uptime 2437130, samples 7, length 1320 flow sample (1), length 208, flow sample (1), length 148, flow sample (1), length 208, counter sample (2), length 168, counter sample (2), length 168, counter sample (2), length 168, counter sample (2), length 168, when I was expecting something rather more verbose. I've uploaded the pcap file to ftp://ftp.netperf.org/netperf/misc/sflow.pcap.gz . This time it is from a completely private switch doing nothing but sending sflow counters and configured for some flow samples while I was running a single instance of netperf through it. rick jones - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- [PATCH] print-sflow.c - actually print more than one extended counter sample Rick Jones (Apr 01)
- Re: [PATCH] print-sflow.c - actually print more than one extended counter sample Guy Harris (Apr 01)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 04)
- Re: [PATCH] print-sflow.c - actually print more than one extended counter sample Michael Richardson (Apr 03)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 04)
- Re: [PATCH] print-sflow.c - actually print more Guy Harris (Apr 04)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 05)
- Re: [PATCH] print-sflow.c - actually print more Guy Harris (Apr 04)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 05)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 08)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 12)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 04)
- Re: [PATCH] print-sflow.c - actually print more than one extended counter sample Guy Harris (Apr 01)
- Re: [PATCH] print-sflow.c - actually print more Michael Richardson (Apr 28)
- Re: [PATCH] print-sflow.c - actually print more Michael Richardson (Apr 28)
- Re: [PATCH] print-sflow.c - actually print more Rick Jones (Apr 27)