new clients rc.66 on the server

Peter Van Epp vanepp at sfu.ca
Fri Dec 28 23:27:52 EST 2007


On Fri, Dec 28, 2007 at 06:14:51PM -0500, Carter Bullard wrote:
> The ip address for the -C option is the address of the local interface
> that you want to listen to.  It must be the same address that the
> netflow records are being sent to.  So it should be the IP address
> on your local machine.
> 
> Carter
> 

	Ah, well that reacts somewhat better but still doesn't work:

19:33:27.169059 IP 192.75.244.195.65535 > 142.58.101.253.1025: UDP, length 1464
19:33:27.271121 IP 192.75.244.195.65535 > 142.58.101.253.1025: UDP, length 168
19:33:27.658020 IP 192.75.244.195.65535 > 142.58.101.253.1025: UDP, length 1464
19:33:27.992952 IP 192.75.244.195.65535 > 142.58.101.253.1025: UDP, length 1080
19:33:28.067529 IP 192.75.244.195.65535 > 142.58.101.253.1025: UDP, length 1464

	with the local address it appears to bind to the socket ok but doesn't
see any traffic:

vanepp at sniffer1:~> ra3 -C 142.58.101.253:1025 -n -D10
ra3[5247]: 07-12-28 19:34:06 main: reading files completed
ra3[5247]: 07-12-28 19:34:06 ArgusCalloc (1, 16) returning 0x101f52b8
ra3[5247]: 07-12-28 19:34:06 ArgusNewQueue () returning 0x101f52b8
ra3[5247]: 07-12-28 19:34:06 ArgusPopQueue (0x101f5068) returning 0xf7f48008
ra3[5247]: 07-12-28 19:34:06 Binding 142.58.101.253:1025 Expecting Netflow records
ra3[5247]: 07-12-28 19:34:06 receiving
ra3[5247]: 07-12-28 19:34:06 ArgusGetServerSocket (0xf7f48008) returning 3
ra3[5247]: 07-12-28 19:34:06 ArgusCalloc (1, 1048576) returning 0xf7e47008
ra3[5247]: 07-12-28 19:34:06 ArgusCalloc (1, 2048) returning 0x101f5770
ra3[5247]: 07-12-28 19:34:06 ArgusCalloc (1, 2048) returning 0x101f5f78
ra3[5247]: 07-12-28 19:34:06 ArgusParseInit(0xf7faf008 0xf7f48008
ra3[5247]: 07-12-28 19:34:06 ArgusReadConnection(0xf7f48008, 2) reading cisco wire format
ra3[5247]: 07-12-28 19:34:06 ArgusReadConnection(0xf7f48008, 2) returning 0
ra3[5247]: 07-12-28 19:34:06 ArgusAddToQueue (0x101f5080, 0xf7f48008) returning 1
ra3[5247]: 07-12-28 19:34:06 ArgusPopQueue (0x101f5068) returning 0x0
ra3[5247]: 07-12-28 19:34:06 ArgusPopQueue (0x101f52b8) returning 0x0
ra3[5247]: 07-12-28 19:34:06 ArgusPopQueue (0x101f52b8) returning 0x0
ra3[5247]: 07-12-28 19:34:06 ArgusFree (0x101f52b8)
ra3[5247]: 07-12-28 19:34:06 ArgusDeleteQueue (0x101f52b8) returning
ra3[5247]: 07-12-28 19:34:06 ArgusReadStream(0xf7faf008) starting
ra3[5247]: 07-12-28 19:34:06 ArgusAdjustGlobalTime global 1198899246.682283
ra3[5247]: 07-12-28 19:34:06 ArgusAdjustGlobalTime global 1198899246.682283
ra3[5247]: 07-12-28 19:34:06 ArgusAdjustGlobalTime global 1198899246.832304
ra3[5247]: 07-12-28 19:34:06 ArgusAdjustGlobalTime global 1198899246.832304
ra3[5247]: 07-12-28 19:34:06 ArgusAdjustGlobalTime global 1198899246.982285
ra3[5247]: 07-12-28 19:34:06 ArgusAdjustGlobalTime global 1198899246.982285
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.132287
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.132287
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.282290
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.282290
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.432291
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.432291
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.582291
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.582291
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.732294
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.732294
ra3[5247]: 07-12-28 19:34:07 ArgusClientTimeout()
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.882295
ra3[5247]: 07-12-28 19:34:07 ArgusAdjustGlobalTime global 1198899247.882295
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.032297
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.032297
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.182299
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.182299
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.332297
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.332297
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.482301
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.482301
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.632303
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.632303
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.782304
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.782304
ra3[5247]: 07-12-28 19:34:08 ArgusClientTimeout()
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.932306
ra3[5247]: 07-12-28 19:34:08 ArgusAdjustGlobalTime global 1198899248.932306
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.082307
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.082307
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.232310
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.232310
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.382310
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.382310
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.532313
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.532313
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.682312
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.682312
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.832316
ra3[5247]: 07-12-28 19:34:09 ArgusAdjustGlobalTime global 1198899249.832316

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada



More information about the argus mailing list