cflowd - seems OK now ;-)

Fri Apr 24 17:28:08 UTC 1998

On Fri, 24 Apr 1998, Leigh Porter wrote:

> Hiya folks,
> 
> With regards to my earlier problem:
> 
> This is an extract of /var/log/messages
> 
> Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
> 928
> Apr 24 18:44:52 mekong cflowd[16202]: [E] recv.c:100 recvfrom() returned
> 1168

<SNIP>

> And the offending code:
> 
> 
>   len = recvfrom(sockfd, (char *)flowpdu, sizeof(*flowpdu),0,
>            (struct sockaddr *)&Saddr,&alen);
>   if (len < (sizeof(FLOW_PDU_HDR) + (ntohs(flowpdu->header.count) *
>                                      sizeof(FLOW_PDU_ENTRY))))
>   {
>     syslog(LOG_ERR,"[E] %s:%d recvfrom() returned %d",
>            __FILE__,__LINE__,len);
>     return(-1);
>   }

Yes, we figured this out too.   Se below for a solution

> It was getting the flow data all the time, bit it did not like it.
> 
> I am running 11.2.(9)P on which the command:
> 
> ip flow-export version 5 origin-as
> 
> Does not exist, only the following is there:
> 
> ip flow-export dest
> 
> Is it a version problem?

Yes, it is a version problem.  Cflowd only works with version 5 of 
cisco flows (without code mods).  The approriate config line would 
be:

ip flow-export version 5 ...

Unfortunately it looks like this is only in 11.1(?)

bye,
ken emery