[Bug 428315] New: ntop rrd creation/management error with pcap dump
https://bugzilla.novell.com/show_bug.cgi?id=428315 Summary: ntop rrd creation/management error with pcap dump Product: openSUSE 11.0 Version: Final Platform: x86 OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Other AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: diego.ercolani@gmail.com QAContact: qa@suse.de Found By: Community User I have a machine wich I used for sniffing purposes, I left it alone and dump traffic with tcpdump in 200MB sized files. Now I have to analyze the traffic with ntop to have statistical information to debug a connection. As ntop can process pcap capture files I've done this trick: Working directory /home I created a fifo called dump.fifo (read permission by common user) then this one line script that cat dumpfiles through fifo (filenames are chronologically ordered): for i in $(ls -tr1 dump08*); do echo $i; cat $i > dump.fifo; done in another terminal I execed the ntop program: ntop -P /tmp/ntop -f /home/dump.fifo -m 10.1.102.0/24 -s -w 3001 -W 0 ntop runs in foreground and complaint about rrd files: lun 22 set 2008 13:28:21 CEST **WARNING** RRD: rrd_update(/tmp/ntop/interfaces//home/dump.fifo/throughput.rrd) error: opening '/tmp/ntop/interfaces//home/dump.fifo/throughput.rrd': No such file or directory lun 22 set 2008 13:28:31 CEST **WARNING** RRD: rrd_create(/tmp/ntop/interfaces//home/dump.fifo/throughput.rrd) error: Invalid alpha: must be between 0 and 1 lun 22 set 2008 13:28:31 CEST **WARNING** RRD: rrd_update(/tmp/ntop/interfaces//home/dump.fifo/throughput.rrd) error: opening '/tmp/ntop/interfaces//home/dump.fifo/throughput.rrd': No such file or directory I've found that this problem is very common but I didn't find any solution..... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=428315 Andreas Jaeger <aj@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |bg@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=428315 User bg@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=428315#c1 Berthold Gunreben <bg@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |WORKSFORME --- Comment #1 from Berthold Gunreben <bg@novell.com> 2008-10-02 05:48:00 MDT --- I don't see this on a 11.0 GA system. However, I just did one single tcpdump -w and did not try to cat different files together. Maybe the dump is corrupt. Here, it just worked as expected. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=428315 User diego.ercolani@gmail.com added comment https://bugzilla.novell.com/show_bug.cgi?id=428315#c2 --- Comment #2 from Diego Ercolani <diego.ercolani@gmail.com> 2008-10-02 06:38:20 MDT --- Uhm... dump files are imported correctly (eating a bunch of RAM) by whireshark. Even if they are corrupt, ntop parser should manage the situation in some manner, like a lack of frame interval o something like this. by the way: my tcpdump line was tcpdump -C 200 -i br0 -l -w dump`date +"%y%m%d%H%M"` -s0 '!host 10.1.102.2' -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@novell.com