[flow-tools] flow-report ip-destination-address-source-count broken?

Russell Dwarshuis rjd@merit.edu
Thu, 9 Jan 2003 11:50:51 -0500 (EST)


I'm not getting anything useful out of ip-destination-address-source-count
from flow-report.  With similar configurations (in the same config file) I
get valid reports for all other reports I've tried, including
ip-source-address-destination-count and ip-destination-address

I'm using version 0.63 with the patch at
http://www.pairlist.net/pipermail/flow-tools/2002-December/000928.html

When fed previously tagged flows,
flow-cat ft-v1005.2003-01-08.* | flow-report -s /tmp/stat.conf -S report0
gives:
# recn: ip-destination-address,flows,octets,packets,duration
0.0.0.31,939407,895335817,2628906,7736751156

/tmp/stat.conf:
include-filter /tmp/filter.conf

stat-report SUBNET-BB_ip-destination-address-source-count
 filter SUBNET-BB_dst
 type ip-destination-address-source-count
   output
    path
/private2/raw_reports/%Y/%m/%d/SUBNET-BB_ip-destination-address-source-count

stat-definition report0
 report SUBNET-BB_ip-destination-address-source-count

/tmp/filter.conf:
filter-primitive SUBNET-BB
 type tag
 permit 0x100F

filter-definition SUBNET-BB_src
 match src-tag SUBNET-BB
filter-definition SUBNET-BB_dst
 match dst-tag SUBNET-BB
filter-definition SUBNET-BB
 match src-tag SUBNET-BB
 or
 match dst-tag SUBNET-BB


-----------
Thanks in advance,

                                          -Russell Dwarshuis