search

CESNET / ipfixcol

IPFIXcol is an implementation of an IPFIX (RFC 7011) collector
Other
64 stars 37 forks source link

fbitdump filtering on da6/dstip6 gives empty result set #104

Closed DRiKE closed 8 years ago

DRiKE commented 9 years ago

Selecting an IPv6 address that is definitely in the data, via

fbitdump -R path/to/fbit_flows -o long6 -c10

and using that to filter the data on, like

fbitdump -R path/to/fbit_flows '%dstip6 == 2001:db8:1911:b111::148:14:0'

does not yield any results, while they are expected. There is no difference in using da6, dstip6, =, ==. If needed, I can provde the dataset for this.

thorgrin commented 9 years ago

This might be related to a known bug in FastBit library. Could you send me that data set to thorgrin |at| cesnet.cz? It works fine on my data.

thorgrin commented 8 years ago

I've tracked it down to a FastBit issue. You can watch the progress here: https://hpcrdm.lbl.gov/pipermail/fastbit-users/2015-July/002107.html After the FastBit guys fix this, I'll update out clone of the FastBit library and close the issue.

DRiKE commented 8 years ago

Thanks a lot, I'll keep an eye on that.

On Mon 27 Jul 2015, 22:55, Petr Velan wrote:

I've tracked it down to a FastBit issue. You can watch the progress here: https://hpcrdm.lbl.gov/pipermail/fastbit-users/2015-July/002107.html After the FastBit guys fix this, I'll update out clone of the FastBit library and close the issue.

Reply to this email directly or view it on GitHub: https://github.com/CESNET/ipfixcol/issues/104#issuecomment-125459242

thorgrin commented 8 years ago

I've just got an answer from the FastBit developers. We need to say that the filtered numbers are long and unsigned. I've just push an update to devel branch that should fix it for default types such as mac addresses and IPv6. The filter now also allows to add UL to any number so that the FastBit will treat it as unsigned long instead of double.