Cflow/FlowScan with OSU flow-tools (was "Re: (from flow-tools list) ...")

Date view Thread view Subject view Author view

Subject: Cflow/FlowScan with OSU flow-tools (was "Re: (from flow-tools list) ...")
From: Dave Plonka (plonka@doit.wisc.edu)
Date: Fri May 25 2001 - 08:55:10 CDT 

In case it's not clear, Andrew is doing some preliminary testing of
Cflow.pm with the OSU flow-tools collector called flow-capture (instead
of cflowd).

On Fri, May 25, 2001 at 04:02:22PM +1000, Andrew Fort wrote:
> Okay I admit, I failed to read all the docco :)
> 
> I noticed the bit about "for use with OSU flow-tools...", I'm not sure
> exactly how one is supposed to compile Cflow with OSU support, I've tried a
> couple of different directory placements, but I'm missing something.
> 
> What's the correct order and placement of the Cflow-1.036.tar.gz contents so
> that it builds with OSU support?

When attempting to build Cflow w/support for OSU flow-tools, go into
the "flow-tools-0.53/perl" directory, then extract "Cflow-1.036.tar.gz"
there.  You need to do this because the current Cflow package looks for
flow-tools stuff to be in "../..".  If it doesn't find it, it will just
have cflowd support (which is what you're seeing I think).

Be sure when you do "perl Makefile.PL" that it says something like:

   Looks good
   Found flow-tools... using "-DOSU -I../../lib -I../../lib/.. -L../../lib -lz -lft".
   ^^^^^^^^^^^^^^^^
   
BTW, those are the build instructions (albeit in parentheses) here:

   http://net.doit.wisc.edu/~plonka/Cflow/

i.e.:

   installation
   ------------

      (For use with OSU flow-tools, this package should be
       extracted/placed in the "perl" sub-directory of the flow-tools
       distribution.  Proceed after successfully completing the
       flow-tools build.)

> >However, even using Cflow-1.036, flowscan isn't recognising 
> >the flow-tools -V5 fileformat - i'm guessing I'm doing something wrong:

Once you have Cflow working with OSU flow-tools flow files (e.g. by
testing with "flowdumper -s"), it is *theoretically* possible to use
FlowScan with OSU flow-tools.

If you want to experiment with using FlowScan atop OSU flow-tools,
you'll need at least revision 1.6 of the file "FlowScan.pm" (which I've
attached) installed in your FlowScan "$prefix/bin" dir.  This is is a
newer file than was suplied in FlowScan-1.006 and is necessary because
the timestamp in the flow-tools file names is slightly different than
it was from the patched cflowd.  I have _not_ tested this yet, so
please give me feedback on whether the changes I've made there will
work to grok the timestamp in the raw flow file names as produced by
flow-tools-0.53 when you do:

   flow-capture -N0 -V5 -n287 -w/var/local/flows /10.42.69.1/2055
                      ^
                      or 6, or 7 (for MSFC)
                      
You'll also need to change the FlowFileGlob in "flowscan.cf":

   # glob matching OSU flow-tools file names:
   FlowFileGlob ft-v*[0-9]

Remember, I haven't found time to run FlowScan w/OSU flow-tools yet.
I'd like to advertise compatibility in the next release though, so let
us know what happens.

Dave

-- 
plonka@doit.wisc.edu  http://net.doit.wisc.edu/~plonka  ARS:N9HZF  Madison, WI
-- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/

Date view Thread view Subject view Author view

This archive was generated by hypermail 2b25 : Fri May 25 2001 - 08:59:34 CDT