Closed ytti closed 4 years ago
Either restart itself or upgrade to 1.6.18 fixed this.
The likely problem here is that between versions samplingInterval moves from template 258 to 257 and what used to be samplingInterval is now selectorID (0), which somehow messes up nfcapd and causes it to create another sampler, instead of updating existing one to 0 (and later when it sees template back to reasonable number).
1.6.18 does not fix, but restart fixes.
I can see
This seems bit random which is first, if mode2, interval0 is observed first, we report 0bytes/0packets, I assume because we multiply with 0. If mode0 is seen first, we report correct bytes/packets.
PCAPs from devices are identical, only interval reported is 10922 with random algorithm.
Devices are PTX1k exporting IPFIX.
Perhaps selectorId 0 is parsed as sampler?