Netflow 9 and srcid/smac/dmac

Richard Rothwell via Argus-info <[email protected]>
Newsgroups gmane.network.argus
Message-ID <[email protected]>
Hi Carter,

The new argus_import.c  file you provided has been added to the source compilation and the argus clients have been rebuilt as follows:

./configure; make clean; make
make install

nprobe was run:

nprobe --collector-port 9412 -n 127.0.0.1:9012 -V 9 --daemon-mode

Then radium was rerun:

/usr/local/sbin/radium -S cisco://any:9012 -d -e 12 -P 562 -- local dur lte 300

and the output checked via:

bin/ra  -S localhost:562  -s +srcid +smac +dmac -  local dur lte 300

to produce:

         StartTime      Flgs  Proto            SrcAddr  Sport   Dir            DstAddr  Dport  TotPkts   TotBytes State              SrcId             SrcMac             DstMac
   05:25:03.427000 Ne           tcp        122.3.81.45.33492     ->    144.110.139.209.telnet        1         60   REQ                     00:00:00:00:02:84  00:00:00:00:02:e2
   05:25:00.426000 Ne           udp     220.249.99.149.megar*    ->     118.139.77.174.6956          1         93   REQ                     00:00:00:00:02:84  00:00:00:00:03:0a
   05:25:03.426000 Ne           tcp    149.144.222.115.64996     ?>     17.248.155.143.https         4        711   CON                     00:00:00:00:03:00  00:00:00:00:02:d9
   05:25:01.424000 Ne           tcp       128.250.0.44.37326     ?>    103.245.222.193.https         3        685   CON                     00:00:00:00:03:38  00:00:00:00:02:d9

So it looks like the input and output fields are there now, but srcid is still missing. Excellent, progress is being made!

Regards from Richard
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.