Bug #32845 for Net-Flow: Net::Flow - version 9 template issues

Thu Jan 31 20:33:23 2008 heath [...] snoek.com.au - Ticket created

Subject:	Net::Flow - version 9 template issues
Date:	Fri, 01 Feb 2008 12:30:46 +1100
To:	bug-Net-Flow [...] rt.cpan.org
From:	Heath Snoek <heath [...] snoek.com.au>

Module version: Net-Flow 0.02 hugo:~# perl -v This is perl, v5.8.8 built for i486-linux-gnu-thread-multi hugo:~# uname -a Linux hugo 2.6.18-5-686 #1 SMP Mon Dec 24 16:41:07 UTC 2007 i686 GNU/Linux I'm receiving the following output when using your example 1 from the Net::Flow POD, I'm offloading using netflow version 9: - Header Information - Count = 29 SequenceNum = 136076 SourceId = 0 SysUpTime = 438982036 UnixSecs = 1201828685 VersionNum = 9 WARNING : NOT FOUND TEMPLATE = 256 WARNING : UNMATCH FLOW COUNT - Header Information - Count = 29 SequenceNum = 136077 SourceId = 0 SysUpTime = 438987036 UnixSecs = 1201828690 VersionNum = 9 WARNING : NOT FOUND TEMPLATE = 256 WARNING : UNMATCH FLOW COUNT The template not found an error seems to alternate between '256' and a '257'. I'd be grateful if you have any ideas, thanks in advance. Regards Heath

Fri Feb 01 01:52:30 2008 akoba [...] nttv6.net - Correspondence added

From:

akoba [...] nttv6.net

On 木曜日 1月 31 20:33:23 2008, heath@snoek.com.au wrote: Show quoted text

> Module version: Net-Flow 0.02 > hugo:~# perl -v > This is perl, v5.8.8 built for i486-linux-gnu-thread-multi > hugo:~# uname -a > Linux hugo 2.6.18-5-686 #1 SMP Mon Dec 24 16:41:07 UTC 2007 i686

GNU/Linux Show quoted text

> > I'm receiving the following output when using your example 1 from

the Show quoted text

> Net::Flow POD, I'm offloading using netflow version 9: > > - Header Information - > Count = 29 > SequenceNum = 136076 > SourceId = 0 > SysUpTime = 438982036 > UnixSecs = 1201828685 > VersionNum = 9 > WARNING : NOT FOUND TEMPLATE = 256 > WARNING : UNMATCH FLOW COUNT > > - Header Information - > Count = 29 > SequenceNum = 136077 > SourceId = 0 > SysUpTime = 438987036 > UnixSecs = 1201828690 > VersionNum = 9 > WARNING : NOT FOUND TEMPLATE = 256 > WARNING : UNMATCH FLOW COUNT > > The template not found an error seems to alternate between '256' and

a Show quoted text

> '257'. > > I'd be grateful if you have any ideas, thanks in advance. > > Regards > Heath

Hi Heath, Hi Heath, Generally, NetFlow agent sends template flowset periodically. Therefore, Net::Flow modulle needs to input template flowset as $TemplateArrayRef, if single NetFlow packet doesn't include template flowset. Although several NetFlow packet doesn't include template flowset after startup example 1 script soon and you get following error messages, it can decode following packets and stop warning messages after example 1 receives template flowset at once. This is not bug. Best Regards, Atsushi Kobayashi

Fri Feb 01 01:52:33 2008 The RT System itself - Status changed from 'new' to 'open'

Fri Feb 01 01:53:47 2008 akoba [...] nttv6.net - Correspondence added 10 min

please see the reply messages.

Fri Feb 01 01:53:50 2008 akoba [...] nttv6.net - Status changed from 'open' to 'resolved'

Fri Feb 01 01:53:51 2008 akoba [...] nttv6.net - Given to AKOBA