Wireshark-users: [Wireshark-users] cflow v9 dissector oddity

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Yann Berthier <yb@xxxxxxxxxxxxxx>
Date: Sun, 26 Nov 2006 23:10:05 -0500
   Hello,

   On a capture of netflow v9 traffic from 2 routers, where r1 exports
   data flowsets using template id 257 and template flowsets of said id
   of 21 fields, and r2 exports a template flowset for id == 257 of 23
   fields, wireshark (0.99.4) mixes-up the templates when decoding the
   flowsets from r1 - it uses the last template cached, be it from r1
   or r2, to decode the data flowsets from r1

   same traffic splitted (capture filter) per source is decoded ok
   
   thanks,
   
      - yann 

   PS: please keep me cc:ed, i'm not subscribed