nfprofile: Skip unknown record type 13 (after upgrrading from 1.6.20 to 1.7.3) about nfdump HOT 8 CLOSED

Yes - that's correct. It looks like you have an exporter, which exports interface names (ASA firewall?). These names go into a special data array record of type 13. As this is not a flow record, nfprofile can not deal with this record and skips it.
This has no influence of the filtering of flow records, however, if you want to list the associated interface names of flow records in a profile, no names will show up.
I need to patch nfprofile for that.

from nfdump.

It looks like you have an exporter, which exports interface names (ASA firewall?).

It is service router Eltex-3100. Upgrading firmware and switching between netflow 5 and 9 does not resolve problem.

I need to patch nfprofile for that.

I'd like at least to suppress logging of this messages. Will wait you patch.

Thanks!

from nfdump.

@avamal - Would you mind to capture a few minutes of the netflow traffic, sent to the collector? - Just tcpdump those traffic and send it to my email in the AUTHORS file. This would help me to understand those flows and improve the software.
I would prefer the v9 flows.
Thanks

from nfdump.

Yes, of course. Tomorrow I'll do it.

from nfdump.

Fixed in master repo

from nfdump.

Good to see this being already fixed ;-) - I just bumped into this as well, after upgrading 1.6 to 1.7.3 (FreeBSD port).

Not sure which device is causing this over here, either IOS XR or Arista EOS (nfprofile doesn't tell which file it encountered this).

from nfdump.

@cron2 - It’s not a bug in one of your exporters, but the profiler did not handle correctly the sampler records. Therefore I would recommend you to upgrade to 1.7.4.

from nfdump.

Thanks. Have upgraded to 1.7.4, and the nfprofile messages are gone.

Have opened a FreeBSD PR to get the port updated as well (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277572)

from nfdump.