From owner-rtfm@auckland.ac.nz Fri Apr 19 23:51:51 2002 Received: from net.auckland.ac.nz ([130.216.191.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA17265 for ; Fri, 19 Apr 2002 23:51:49 -0400 (EDT) Received: (from majordom@localhost) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id OAA29312; Sat, 20 Apr 2002 14:32:48 +1200 (NZST) Received: from smtpout.mac.com (smtpout.mac.com [204.179.120.86]) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id OAA29307 for ; Sat, 20 Apr 2002 14:32:46 +1200 (NZST) Received: from smtp-relay02.mac.com (smtp-relay02-qfe3 [10.13.10.225]) by smtpout.mac.com (8.12.1/8.10.2/1.0) with ESMTP id g3K2WiW5010674 for ; Fri, 19 Apr 2002 19:32:44 -0700 (PDT) Received: from asmtp02.mac.com ([10.13.10.66]) by smtp-relay02.mac.com (Netscape Messaging Server 4.15 relay02 Jun 21 2001 23:53:48) with ESMTP id GUUHQF00.HNK for ; Fri, 19 Apr 2002 19:32:39 -0700 Received: from [192.168.2.100] ([200.67.251.58]) by asmtp02.mac.com (Netscape Messaging Server 4.15 asmtp02 Jun 21 2001 23:53:48) with ESMTP id GUUHQE00.31U for ; Fri, 19 Apr 2002 19:32:38 -0700 Subject: firsttime/lasttime From: Carlos del Castillo To: rtfm@auckland.ac.nz Content-Type: text/plain Content-Transfer-Encoding: 7bit X-Mailer: Ximian Evolution 1.0.3 Date: 19 Apr 2002 21:32:37 -0500 Message-Id: <1019269958.2697.8.camel@ccastillo> Mime-Version: 1.0 Sender: owner-rtfm@auckland.ac.nz Precedence: bulk Content-Transfer-Encoding: 7bit Hello everybody, I'm new to netramet, I have been doing some tests and everything is working fine, but I really don't understand the fileds firsttime and lasttime. In the documentation I read that this files are the time in seconds/100 since that flow was first seen and last seen. But the problem is that if i started the NetFlowMet and NeMaC process a few minutes ago, I get values really big. About 2154190161. What does this mean? Do I have a problem or is it a bug? Thank you very much. Carlos del Castillo capc75 at mac dot com From owner-rtfm@auckland.ac.nz Sun Apr 21 19:49:15 2002 Received: from mailhost2.auckland.ac.nz (mailhost2.auckland.ac.nz [130.216.191.4]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03039 for ; Sun, 21 Apr 2002 19:49:13 -0400 (EDT) Received: (from majordom@localhost) by mailhost2.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id KAA04223; Mon, 22 Apr 2002 10:08:41 +1200 (NZST) Received: from mailhost.auckland.ac.nz (IDENT:mirapoint@mailhost.auckland.ac.nz [130.216.191.61]) by mailhost2.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id KAA04218 for ; Mon, 22 Apr 2002 10:08:40 +1200 (NZST) Received: from login.caida.org (login.caida.org [192.172.226.78]) by mailhost.auckland.ac.nz (Mirapoint Messaging Server MOS 2.9.3.2) with ESMTP id ACF38248; Mon, 22 Apr 2002 10:08:39 +1200 (NZST) Received: from login.caida.org (localhost [127.0.0.1]) by login.caida.org (8.12.1/8.12.1) with ESMTP id g3LM8bBI030976; Sun, 21 Apr 2002 15:08:37 -0700 (PDT) Received: from localhost (nevil@localhost) by login.caida.org (8.12.1/8.12.1/Submit) with ESMTP id g3LM8agf030973; Sun, 21 Apr 2002 15:08:36 -0700 (PDT) Date: Sun, 21 Apr 2002 15:08:36 -0700 (PDT) From: Nevil Brownlee To: Carlos del Castillo cc: rtfm@auckland.ac.nz Subject: Re: firsttime/lasttime In-Reply-To: <1019269958.2697.8.camel@ccastillo> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-rtfm@auckland.ac.nz Precedence: bulk Hello Carlos: FIrstTime and LastTime are in SNMP TimeTicks, i.e. units of 0.01 s. But the values are relative to the time the meter started, hence the large values you're seeing. NeMaC gives the time of day (or UTC time) when a meter reading began, together with the corresponding SysUpTime value (same untis); you can use that to convert the times to time of day. Or, if you only want the duration of a flow, just subract LastTime-FirstTime. Cheers, Nevil ------------------------------------------------------------- Nevil Brownlee Internet Researcher Phone: (858) 534 8338 CAIDA, San Diego On 19 Apr 2002, Carlos del Castillo wrote: > Hello everybody, I'm new to netramet, I have been doing some tests and > everything is working fine, but I really don't understand the fileds > firsttime and lasttime. > > In the documentation I read that this files are the time in seconds/100 > since that flow was first seen and last seen. > > But the problem is that if i started the NetFlowMet and NeMaC process a > few minutes ago, I get values really big. About 2154190161. > > What does this mean? Do I have a problem or is it a bug? From owner-rtfm@auckland.ac.nz Mon Apr 22 01:56:00 2002 Received: from net.auckland.ac.nz (net.auckland.ac.nz [130.216.1.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA08804 for ; Mon, 22 Apr 2002 01:55:54 -0400 (EDT) Received: (from majordom@localhost) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id QAA12906; Mon, 22 Apr 2002 16:18:37 +1200 (NZST) Received: from smtpout.mac.com (smtpout.mac.com [204.179.120.89]) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id QAA12900 for ; Mon, 22 Apr 2002 16:18:35 +1200 (NZST) Received: from smtp-relay01.mac.com (smtp-relay01-qfe3 [10.13.10.224]) by smtpout.mac.com (8.12.1/8.10.2/1.0) with ESMTP id g3M4IT2W000288 for ; Sun, 21 Apr 2002 21:18:29 -0700 (PDT) Received: from asmtp01.mac.com ([10.13.10.65]) by smtp-relay01.mac.com (Netscape Messaging Server 4.15 relay01 Jun 21 2001 23:53:48) with ESMTP id GUYBYO00.3VZ for ; Sun, 21 Apr 2002 21:18:24 -0700 Received: from [192.168.2.100] ([200.67.251.58]) by asmtp01.mac.com (Netscape Messaging Server 4.15 asmtp01 Jun 21 2001 23:53:48) with ESMTP id GUYBYN00.P03 for ; Sun, 21 Apr 2002 21:18:23 -0700 Subject: Re: firsttime/lasttime From: Carlos del Castillo To: netramet In-Reply-To: References: Content-Type: text/plain Content-Transfer-Encoding: 7bit X-Mailer: Ximian Evolution 1.0.3 Date: 21 Apr 2002 23:18:22 -0500 Message-Id: <1019449103.2946.3.camel@ccastillo> Mime-Version: 1.0 Sender: owner-rtfm@auckland.ac.nz Precedence: bulk Content-Transfer-Encoding: 7bit Thank you very much, I got it. OI could read the sysUpTime with th snmbulkget command. Thank you very much. On Sun, 2002-04-21 at 17:08, Nevil Brownlee wrote: Hello Carlos: FIrstTime and LastTime are in SNMP TimeTicks, i.e. units of 0.01 s. But the values are relative to the time the meter started, hence the large values you're seeing. NeMaC gives the time of day (or UTC time) when a meter reading began, together with the corresponding SysUpTime value (same untis); you can use that to convert the times to time of day. Or, if you only want the duration of a flow, just subract LastTime-FirstTime. Cheers, Nevil ------------------------------------------------------------- Nevil Brownlee Internet Researcher Phone: (858) 534 8338 CAIDA, San Diego On 19 Apr 2002, Carlos del Castillo wrote: > Hello everybody, I'm new to netramet, I have been doing some tests and > everything is working fine, but I really don't understand the fileds > firsttime and lasttime. > > In the documentation I read that this files are the time in seconds/100 > since that flow was first seen and last seen. > > But the problem is that if i started the NetFlowMet and NeMaC process a > few minutes ago, I get values really big. About 2154190161. > > What does this mean? Do I have a problem or is it a bug? From owner-rtfm@auckland.ac.nz Mon Apr 22 01:56:50 2002 Received: from net.auckland.ac.nz (net.auckland.ac.nz [130.216.191.1] (may be forged)) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA08828 for ; Mon, 22 Apr 2002 01:56:49 -0400 (EDT) Received: (from majordom@localhost) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id QAA13265; Mon, 22 Apr 2002 16:21:43 +1200 (NZST) Received: from smtpout.mac.com (smtpout.mac.com [204.179.120.89]) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id QAA13161 for ; Mon, 22 Apr 2002 16:21:01 +1200 (NZST) Received: from smtp-relay02.mac.com (smtp-relay02-qfe3 [10.13.10.225]) by smtpout.mac.com (8.12.1/8.10.2/1.0) with ESMTP id g3M4Ku2W000835 for ; Sun, 21 Apr 2002 21:20:56 -0700 (PDT) Received: from asmtp02.mac.com ([10.13.10.66]) by smtp-relay02.mac.com (Netscape Messaging Server 4.15 relay02 Jun 21 2001 23:53:48) with ESMTP id GUYC2R00.5N0 for ; Sun, 21 Apr 2002 21:20:51 -0700 Received: from [192.168.2.100] ([200.67.251.58]) by asmtp02.mac.com (Netscape Messaging Server 4.15 asmtp02 Jun 21 2001 23:53:48) with ESMTP id GUYC2Q00.DBT for ; Sun, 21 Apr 2002 21:20:50 -0700 Subject: SrcTransMask and DestTransMask From: Carlos del Castillo To: netramet Content-Type: text/plain Content-Transfer-Encoding: 7bit X-Mailer: Ximian Evolution 1.0.3 Date: 21 Apr 2002 23:20:49 -0500 Message-Id: <1019449250.2948.8.camel@ccastillo> Mime-Version: 1.0 Sender: owner-rtfm@auckland.ac.nz Precedence: bulk Content-Transfer-Encoding: 7bit Hello, I have a srl file, but does not compile it claims about SrcTransMask and DestTransMask, it says the following: RROR >>>> Attribute not allowed in FORMAT tmpreaderone.srl 49: SourceTransAddress SourceTransMask DestTransAddress DestTransMask " " ^^^^^^^^^^^^^^^ Why is that, I saw this in an example that compiles whit srl 4.3, I'm currently using NeTraMet 4.3 and srl 4.4. Any ideas? Thanks. From owner-rtfm@auckland.ac.nz Mon Apr 22 10:19:12 2002 Received: from net.auckland.ac.nz (net.auckland.ac.nz [130.216.1.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA26522 for ; Mon, 22 Apr 2002 10:19:11 -0400 (EDT) From: owner-rtfm@auckland.ac.nz Received: (from majordom@localhost) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id BAA17344; Tue, 23 Apr 2002 01:04:08 +1200 (NZST) Received: from e36.com ([203.194.165.225]) by net.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id BAA17338 for ; Tue, 23 Apr 2002 01:04:06 +1200 (NZST) Received: from pc1-hems3-0-cust67.bre.cable.ntl.com ([213.105.87.67] helo=QRJATYDI) by e36.com with smtp (Exim 3.16 #1) id 16zdPZ-0005Zm-00; Mon, 22 Apr 2002 20:59:18 +0800 To: sddsdc@yahoo.com Subject: СПАМ в России - это законно ? X-Priority: 1 X-MSMail-Priority: High X-Mailer: Outlook Express Date: Mon, 22 Apr 2002 15:15:19 +0300 Mime-Version: 1.0 Content-Type: text/plain; charset="KOI8-R" Message-Id: Sender: owner-rtfm@auckland.ac.nz Precedence: bulk WWW.OSIOS.ORG From owner-rtfm@auckland.ac.nz Sat Apr 27 11:36:36 2002 Received: from mailhost2.auckland.ac.nz (mailhost2.auckland.ac.nz [130.216.1.4]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17040 for ; Sat, 27 Apr 2002 11:36:34 -0400 (EDT) Received: (from majordom@localhost) by mailhost2.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id CAA09431; Sun, 28 Apr 2002 02:03:20 +1200 (NZST) Received: from mailhost.auckland.ac.nz (IDENT:mirapoint@mailhost.auckland.ac.nz [130.216.191.61]) by mailhost2.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id CAA09426 for ; Sun, 28 Apr 2002 02:03:20 +1200 (NZST) Received: from auckland.ac.nz (bluebottle.itss.auckland.ac.nz [130.216.4.28]) by mailhost.auckland.ac.nz (Mirapoint Messaging Server MOS 2.9.3.2) with ESMTP id ACL15296; Sun, 28 Apr 2002 02:03:14 +1200 (NZST) Message-Id: <200204271403.ACL15296@mailhost.auckland.ac.nz> Date: Sat, 27 Apr 2002 07:03:59 -0700 (PDT) From: n.brownlee@auckland.ac.nz Subject: Re: SrcTransMask and DestTransMask To: capc75@mac.com cc: rtfm@auckland.ac.nz In-Reply-To: <1019449250.2948.8.camel@ccastillo> MIME-Version: 1.0 Content-Type: TEXT/plain; charset=us-ascii Sender: owner-rtfm@auckland.ac.nz Precedence: bulk Hello Carlos: On 21 Apr, Carlos del Castillo wrote: > Hello, I have a srl file, but does not compile it claims about > SrcTransMask and DestTransMask, it says the following: > > RROR >>>> Attribute not allowed in FORMAT > tmpreaderone.srl 49: SourceTransAddress SourceTransMask > DestTransAddress DestTransMask " " > ^^^^^^^^^^^^^^^ > Why is that, I saw this in an example that compiles whit srl 4.3, I'm > currently using NeTraMet 4.3 and srl 4.4. Looking at the srl compiler code (in rtfm_atr.h) I see that the compiler won't let you use any of the *mask attributes directly. I've tried to remember why I did that - the reasons are something like this: a) The mask field of Pattern Matching Engine instructions is set by the compiler, i.e. you specify it when you tell it to test by saying something like if SourcePeerAddress == 130.216/16 so you know what the mask is. b) To save the mask would require an explicit save statement, and SRL doesn't have one. c) Otherwise the compiler would have to determine which was the last masked comparison, and save the mask for that. Overall, I think that it isn't useful to work directly with masks. If you really need that, you could use one of the meter attributes, like FlowClass, and store a mask width value into that. Doing that, you'd have explicit control. Again, if you're working with NetFlowMet and want to know the ASN prefix lengths, SRL will give you those (i.e. let you use them in test, save, and format statements), they're the SourcePrefix and DestPrefix attributes. Cheers, Nevil ----------------------------------------------------------------------- Nevil Brownlee Director, Technology Development Phone: +64 9 373 7599 x8941 ITSS, The University of Auckland FAX: +64 9 373 7021 Private Bag 92019, Auckland, New Zealand