# PaCkAgE DaTaStReAm fprobe 1 209 # end of header 0707010018ccaa000081a40000000000000000000000014e2cc5b700000106000000b600010002ffffffffffffffff0000000f00000000fprobe/pkginfoPKG=fprobe NAME=fprobe 1.1 i86pc Solaris 11 VERSION=1.1 PSTAMP=25th July 2011 VENDOR=Slava Astashonok EMAIL=http://sourceforge.net/projects/fprobe/ DESC=NetFlow traffic probes ARCH=i386 CATEGORY=utility CLASSES=none BASEDIR=/ ISTATES=S s 1 2 3 RSTATES=S s 1 2 3 0707010018cca9000081a40000000000000000000000014e2cc5b8000001c2000000b600010002ffffffffffffffff0000000e00000000fprobe/pkgmap: 1 209 1 d none /usr ? ? ? 1 d none /usr/local ? ? ? 1 d none /usr/local/sbin 0755 root root 1 f none /usr/local/sbin/fprobe 0755 root root 83888 8327 1311557020 1 d none /usr/local/share 0755 root root 1 d none /usr/local/share/man 0755 root root 1 d none /usr/local/share/man/man8 0755 root root 1 f none /usr/local/share/man/man8/fprobe.8 0644 root root 7414 61902 1311557020 1 i checkinstall 790 2505 1311557142 1 i pkginfo 262 20571 1311557047 07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000b00000000TRAILER!!!0707010018ccaa000081a40000000000000000000000014e2cc5b700000106000000b600010002ffffffffffffffff0000000800000000pkginfoPKG=fprobe NAME=fprobe 1.1 i86pc Solaris 11 VERSION=1.1 PSTAMP=25th July 2011 VENDOR=Slava Astashonok EMAIL=http://sourceforge.net/projects/fprobe/ DESC=NetFlow traffic probes ARCH=i386 CATEGORY=utility CLASSES=none BASEDIR=/ ISTATES=S s 1 2 3 RSTATES=S s 1 2 3 0707010018cca9000081a40000000000000000000000014e2cc5b8000001c2000000b600010002ffffffffffffffff0000000700000000pkgmap: 1 209 1 d none /usr ? ? ? 1 d none /usr/local ? ? ? 1 d none /usr/local/sbin 0755 root root 1 f none /usr/local/sbin/fprobe 0755 root root 83888 8327 1311557020 1 d none /usr/local/share 0755 root root 1 d none /usr/local/share/man 0755 root root 1 d none /usr/local/share/man/man8 0755 root root 1 f none /usr/local/share/man/man8/fprobe.8 0644 root root 7414 61902 1311557020 1 i checkinstall 790 2505 1311557142 1 i pkginfo 262 20571 1311557047 0707010018ccb4000041ed0000000000000000000000024e2cc5b800000000000000b600010002ffffffffffffffff0000000800000000install0707010018ccb5000081ed0000000000000000000000014e2cc61600000316000000b600010002ffffffffffffffff0000001500000000install/checkinstall#!/bin/sh # expected_bits="64" expected_release="5.11" expected_platform="i386" # release=`uname -r` platform=`uname -p` bits=`isainfo -b` # if [ ${platform} != ${expected_platform} ]; then echo "\n\n\n\tThis package must be installed on a ${expected_platform} architecture\n" echo "\tAborting installation.\n\n\n" exit 1 fi if [ ${release} != ${expected_release} ]; then echo "\n\n\n\tThis package must be installed on a ${expected_release} machine\n" echo "\tAborting installation.\n\n\n" exit 1 fi #if [ ${bits} != ${expected_bits} ]; then # echo "\n\n\n\tThis package must be installed on a ${expected_bits} bit machine\n" # echo "\tYour machine is running a ${bits} bit O.S. currently\n" # echo "\tAborting installation.\n\n\n" # exit 1 #fi exit 0 0707010018ccab000041ed0000000000000000000000034e2cc5b800000000000000b600010002ffffffffffffffff0000000500000000root0707010018ccac000041ed0000000000000000000000034e2cc5b800000000000000b600010002ffffffffffffffff0000000900000000root/usr0707010018ccad000041ed0000000000000000000000044e2cc5b800000000000000b600010002ffffffffffffffff0000000f00000000root/usr/local0707010018ccb0000041ed0000000000000000000000034e2cc5b800000000000000b600010002ffffffffffffffff0000001500000000root/usr/local/share0707010018ccb1000041ed0000000000000000000000034e2cc5b800000000000000b600010002ffffffffffffffff0000001900000000root/usr/local/share/man0707010018ccb2000041ed0000000000000000000000024e2cc5b800000000000000b600010002ffffffffffffffff0000001e00000000root/usr/local/share/man/man80707010018ccb3000081a40000000000000000000000014e2cc59c00001cf6000000b600010002ffffffffffffffff0000002700000000root/usr/local/share/man/man8/fprobe.8.TH fprobe 8 "2005-01-29" "fprobe 1.1" .SH NAME fprobe \- a NetFlow probe .SH SYNOPSIS .BI fprobe [\fIoptions\fR] \fIremote:port[/[local][/type]] ...\fR .SH DESCRIPTION .B fprobe \- libpcap-based tool that collect network traffic data and emit it as NetFlow flows towards the specified collector. .SH OPTIONS .TP .B -h Display short help .TP .B -p \fIDon't\fR put the interface into promiscuous mode. Note that even if this option is used, the interface might be in promiscuous mode for some other reason. .TP .B -i \fI\fR Listen on \fIinterface\fR. If unspecified, \fBfprobe\fR will use result of pcap_lookupdev() function. On Linux systems with 2.2 or later kernels, an \fIinterface\fR argument of `\fIany\fR' can be used to capture packets from all interfaces. Note that captures on the `\fIany\fR' device will not be done in promiscuous mode. .br You may use `\fI-\fR' as \fIinterface\fR name to process files produced by \fItcpdump\fR with \fI-w\fR flag. \fBfprobe\fR will read data from \fIstdin\fR. .TP .B -f \fI\fR Filter \fIexpression\fR selects which packets will be captured. If no \fIexpression\fR is given, all packets on the net will be captured. Otherwise, only packets for which \fIexpression\fR is `true' will be captured. .br \fBfprobe\fR use silly IP-packet detection method, so it is bad idea to leave the filter empty. For general use `ip' (-fip) is good filter expression. .br Read .BR tcpdump manual for detailed \fIexpression\fR syntax. .TP .B -s \fI\fR How often scan for expired flows. [default=5] .TP .B -g \fI\fR Fragmented flow lifetime. [default=30] .TP .B -d \fI\fR Idle flow lifetime (inactive timer). [default=60] .TP .B -e \fI\fR Active flow lifetime (active timer). [default=300] .TP .B -n \fI\fR NetFlow version for use (1, 5, 7). [default=5] .TP .B -a \fI
\fR Use \fIaddress\fR as source for NetFlow flow. .TP .B -x \fI[:]\fR Workaround for SNMP interfaces indexes. [default=0] .br The second parameter may be omitted - in this case its value will be equal to the first. .br See BUGS section. .TP .B -b \fI\fR Memory bulk size. [default=200 or 10000] .br Note that maximum and default values depends on compiling options (\fI--with-membulk\fR parameter). .TP .B -m \fI\fR Memory limit for flows cache (0=no limit). [default=0] .TP .B -q \fI\fR Pending queue length. [default=100] .br Each captured packet at first puts into special buffer called `pending queue'. Purpose of this buffer is to separate most time-critical packet capture thread from other. .TP .B -B \fI\fR Kernel capture buffer size (0=don't change). [default=0] .br Increase kernel capture buffer size is most adequate way to prevent packets loss. Unfortunately, at present there is no straight way to set the buffer size throught libpcap, so this option is a hack. Moreover, now this hack take effect only on socket()-based capture mechanisms: it mean that it work on Linux and don't work on BSD systems with their bpf(). .br Note that maximum allowed size of the buffer in Linux limited and generally relatively small, so it should need to change the maximum: sysctl -w net/core/rmem_max=4194304 .TP .B -r \fI\fR Real-time priority (0=disabled). [default=0] .br If parameter greater then zero \fBfprobe\fR will use real-time scheduling policy to prevent packets loss. Note that possible values for this option depends on operating system. .TP .B -t \fI\fR Emitting rate limit (0:0=no limit). [default=0:0] .br Produce \fIN\fR nanosecond delay after each \fIB\fR bytes sent. This option may be useful with slow interfaces and slow collectors. Note that the suspension time may be longer than requested because the argument value is rounded up to an integer multiple of the sleep resolution (it depends on operating system and hardware) or because of the scheduling of other activity by the system. .br See BUGS section. .TP .B -S \fI\fR Snaplen (0=whole packet). [default=256] .br Number of bytes to capture from packet on wire. .TP .B -K \fI\fR Link layer header size. By default \fBfprobe\fR take this information from libpcap, but sometimes obtained size unsuitable for our purpose. It occurs, for example, on trunk interfaces in VLAN enviroment, where link layer header contain additional VLAN header. .br See EXAMPLES section. .TP .B -k Don't exclude link layer header from packet size. By default \fBfprobe\fR counts only IP-part of packet. .TP .B -c \fI\fR Directory to chroot to. .TP .B -u \fI\fR User to run as. .TP .B -v \fI\fR Maximum displayed log level. (0=EMERG, 1=ALERT, 2=CRIT, 3=ERR, 4=WARNING, 5=NOTICE, 6=INFO, 7=DEBUG) [default=6] .TP .B -l \fI<[dst][:id]>\fR Log destination (0=none, 1=syslog, 2=stdout, 3=both) and log/pidfile identifier. [default=1] .br This option allows to select opportune log destination and process identifier. The identifier helps to distinguish pidfile and logs of one \fBfprobe\fR process from other. .br Note that if log destination contains `\fIstdout\fR' (equal 2 or 3) \fBfprobe\fR will run in foreground. .TP .B remote:port/local/type Parameters \fIremote\fR and \fIport\fR are respectively define address and port of the NetFlow collector. .br The \fIlocal\fR parameter allows binding certain local IP address with specified collector. If the parameter is omitted the value (if any) of \fI-a\fR option will be used. .br The \fItype\fR parameter determines emitting behavior. It may be `m' for mirroring (by default) and `r' for collectors round-robin rotating. .br You may specify multiple collectors. .SH EXAMPLES Web traffic trivial capturing: .br \fBfprobe -ippp0 -f"tcp&&port 80" localhost:2055\fR .br Capturing from trunk interface: .br \fBfprobe -ieth0 -f"vlan&&ip" -K18 localhost:2055\fR .br Reasonable configuration to run under heavy load: .br \fBfprobe -fip -B4096 -r2 -q10000 -t10000:10000000 localhost:2055\fR Send packets to collector at 10.1.1.1:2055 and distribute them between collectors at 10.1.1.2:2055 and at 10.1.1.3:2055 on a round-robin basis: .br \fBfprobe 10.1.1.1:2055 10.1.1.2:2055//r 10.1.1.3:2055//r\fR .SH BUGS .B SNMP interfaces indexes and packet direction. .br Unfortunately libpcap don't provide any routing-related information about captured packet, therefore there are no straight ways to determine and distinguish input and output interfaces. However \fI-x\fR option at least can tell that flow was passed through the certain interface. Also you may launch several instances of the program with tricky set of filters to mark out each possible packet direction: .br \fBfprobe -x1:2 -ieth1 -f"ip&&dst net 10.2" localhost:2055\fR .br \fBfprobe -x2:1 -ieth2 -f"ip&&dst net 10.1" localhost:2055\fR .B Slow interfaces and slow collectors. .br There are may be problems with slow interfaces and slow collectors. It effects as emitted packets loss. On the one hand silent non-blocking sendto() implementation can't guarantee that packet was really sent to collector - it may be dropped by kernel due to outgoing buffer shortage (slow interface's problem) and on the other hand packet may be dropped on collector's machine due the similar reason - incoming buffer shortage (slow collector's problem). .br Use \fI-t\fR option as workaround for this issue. .SH SEE ALSO .BR tcpdump .BR pcap(3) .br .BR http://www.cisco.com/go/netflow 0707010018ccae000041ed0000000000000000000000024e2cc5b800000000000000b600010002ffffffffffffffff0000001400000000root/usr/local/sbin0707010018ccaf000081ed0000000000000000000000014e2cc59c000147b0000000b600010002ffffffffffffffff0000001b00000000root/usr/local/sbin/fprobeELF`748B4 (#"44o@@@@< 'p/usr/lib/ld.so.1  !"$%&),.0234567:;<>ABCFGHILOQSTVWYZ[\^_`abcejlnqrstvwz|~ #'(*+-/189=?@DEJKMNPRUX]dfghikmopuxy{}#/9p8  >8  88  F8( LV]cox""0656m @27n_  -9 7"P@4X*D02wP633 < 4"("Ђ6"S\t"""i x4P3" J  5%@;`2N2T04[v(3"<2n( l 7{ @" r (@61pP4_5v""p33"" 35 6ď"&Ј$/$84Dpj N2V$_$h3o""Hs$"\  o PC ,R8"6t`4|ds, 43=p6tL " sP5*"F<"d 7mG. @3`: "6&216`6[ "b9< h7p6=Xw,"4"5@9" 2" 1% pr  2 5N 5W @7^ @i d  " 4 T    4, p43 "R i " " @ `7 6 05 3   G  6 ") "H i ԏ"$ 2 2 " 2 6'07 "  p9( " 4 3 " 0"4 5C 4J 4\ 1@"f 6m 9M v " ȏ" 03`$! >  P7" "  MS % l) 2@ "] ̏"r 6x 5 p2 @5 2 :B 3 1  P2 `3"@N2 Eb6h"34"5Џ""|0; @P4@r/ !5 1<"C4N6U2Z`5`p5fprobecrti.scrt1.ocrt1.sfsr.svalues-Xa.cfprobe.cfstatlstat_xmknodnetflow.chash.cmem.cmy_getopt.cmy_log.ccrtn.s.XAKk4DpcWMLOl$t.sig_mask.XAKk4DpcWMLOl$t.off_tlinet_ntoapthread_mutex_initfcntlmem_freefprintfmy_getoptmem_init.XAKk4DpcWMLOl$t.parms__1cG__CrunMdo_exit_code6F_v_getuptime.XAKk4DpcWMLOl$t.pidfilefreopen.XAKk4DpcWMLOVAu.NetFlow7_Flow.XAKk4DpcWMLOl$t.inactive_lifetimeselectfreeaddrinfostrlenput_into.XAKk4DpcWMLOVDu.my_log_indent.XAKk4DpcWMLO1Bu.element_size.XAKk4DpcWMLOl$t.scan_interval.XAKk4DpcWMLOl$t.scan_mutex.XAKk4DpcWMLOFBu.crc16_table.XAKk4DpcWMLOVAu.NetFlow5_Header.XAKk4DpcWMLOl$t.peerstotal_elements.XAKk4DpcWMLOl$t.emit_counthash.XAKk4DpcWMLOl$t.emit_mutexpcap_geterrmemset.XAKk4DpcWMLOl$t.emit_rate_bytespcap_callbacksigemptyset_GLOBAL_OFFSET_TABLE_pthread_mutex_lockhtonlsetsid.XAKk4DpcWMLOl$t.verbosity_DYNAMIC__environ_lockpcap_loop.XAKk4DpcWMLOl$t.pw.XAKk4DpcWMLO1Bu.limit_memory.XAKk4DpcWMLO1Bu.mem_mutexhtons.XAKk4DpcWMLOVAu.NetFlow5_Flowmem_alloc__fsr__iobmy_logvsnprintf.XAKk4DpcWMLOl$t.bulk_quantitypcap_open_livepthread_setconcurrencytotal_memory.XAKk4DpcWMLOl$t.pcap_handle.XAKk4DpcWMLOl$t.unpending_timeoutstrchrsprintf.XAKk4DpcWMLOl$t.pending_tail_endkillpthread_creategettime.XAKk4DpcWMLOl$t.pidNetFlow1NetFlow5pcap_filenohash_init_lxstatNetFlow7_environmalloc.XAKk4DpcWMLOl$t.start_time_offset.XAKk4DpcWMLOl$t.emit_rate_delay.XAKk4DpcWMLO1Bu.bulk_quantity.XAKk4DpcWMLOVDu.my_log_names.XAKk4DpcWMLOl$t.sigsemit_thread.XAKk4DpcWMLOl$t.log_dest.XAKk4DpcWMLOl$t.pending_queue_length.XAKk4DpcWMLOVDu.my_log_min_levelsetvbuf_fini.XAKk4DpcWMLOVAu.NetFlow1_Header.XAKk4DpcWMLOl$t.emit_condbindgetpwnam.XAKk4DpcWMLOl$t.netflow__longdouble_used.XAKk4DpcWMLOl$t.thid_lib_versionpthread_sigmask.XAKk4DpcWMLOl$t.npeers_rot.XAKk4DpcWMLOVDu.my_log_flagscloselog.XAKk4DpcWMLOl$t.active_lifetimescan_threadsched_get_priority_maxcopy_flow.XAKk4DpcWMLOl$t.snmp_output_index.XAKk4DpcWMLOVAu.NetFlow1_Flowpthread_cond_signalatexit.XBKk4DpcWMLOl$t.main.threadsremove.XBKk4DpcWMLOlCu.my_getopt.my_opterrusageopenlog__xtol.XAKk4DpcWMLO1Bu.element_table_sizepcap_compile.XAKk4DpcWMLOl$t.killed.XAKk4DpcWMLOl$t.unpending_mutexsetgroupssighandler___errno.XAKk4DpcWMLOl$t.scan_frag_dreg_exitmy_log_closepthread_attr_setschedpolicysetregidsyslogcrc16.XAKk4DpcWMLOl$t.start_time.XAKk4DpcWMLOl$t.emit_timepcap_lookupdev.XBKk4DpcWMLOlCu.my_getopt.flag.XAKk4DpcWMLOl$t.emit_timeout.XAKk4DpcWMLOl$t.scan_cond.XAKk4DpcWMLOl$t.sched_minpcap_datalinkgetpid.XAKk4DpcWMLOFBu.shuffle_table.XAKk4DpcWMLOl$t.flows.XAKk4DpcWMLO1Bu.malloc_sizeoptind___Argv_startsrandsigaddsetgetaddrinfo.XAKk4DpcWMLOl$t.sched_max.XAKk4DpcWMLOl$t.unpending_condunpending_threadsetreuid.XAKk4DpcWMLOl$t.link_layer.XAKk4DpcWMLOl$t.emit_sequence.XAKk4DpcWMLOVAu.NetFlow7_Header.XAKk4DpcWMLOl$t.schedpnanosleep_xstat.XAKk4DpcWMLOl$t.npeers_fxstat.XAKk4DpcWMLO1Bu.mem_index_table_size__fsr_init_valuefree_elementsconnectstrcat.XAKk4DpcWMLOl$t.off_nl.XAKk4DpcWMLO1Bu.rootpcap_setfiltersocketpcap_open_offline__fpstartfclosecmpmtime.XAKk4DpcWMLOFBu.crc16_poly.XAKk4DpcWMLOl$t.promiscsched_get_priority_minfill_get_exit_frame_monitor.XAKk4DpcWMLOl$t.snmp_input_index.XAKk4DpcWMLOl$t.filterpcap_threaddltpthread_cond_timedwait.XAKk4DpcWMLOl$t.sockbufsize.XAKk4DpcWMLOl$t.devfopenpthread_detachpthread_mutex_unlocksigactionntohshash_flowstrerror_PROCEDURE_LINKAGE_TABLE_.XAKk4DpcWMLOl$t.identgettimeofdayatoi.XAKk4DpcWMLOl$t.emit_packet.XAKk4DpcWMLOl$t.link_layer_sizemain.XAKk4DpcWMLOl$t.flows_mutexfread.XAKk4DpcWMLOl$t.flows_emitsscanf.XBKk4DpcWMLOlCu.my_getopt.optstringpthread_attr_init.XAKk4DpcWMLOl$t.pidfilepath.XAKk4DpcWMLOl$t.pending_head_edatafind_etextforkmy_log_openpthread_attr_setschedparamoptargsetsockoptcallocsendchdir.XAKk4DpcWMLOl$t.frag_lifetimechrootlibnsl.so.1SUNW_0.7libsocket.so.1SUNW_1.4libc.so.1SUNW_1.23SUNW_1.18SUNW_1.1SUNW_0.9SUNWprivate_1.1SYSVABI_1.3libpcap.so.1/usr/local/lib:/lib:/usr/lib (= 0'= (= yy'= (= (=  qN 7                                            F ~'g|61[EeHbmv8=>tJs2oO+*#{h<i@n-D!XY]Bdf0`.5axRNWu,Ac)(jyGM/SH @"5 "s""LPTpX\`Jdhlpt'x|(1~o-Bk">?M_^)Z9H y! $%(,0e48<:@DHLCPT|X\`dhl7ptrx`|DvYuh5D%H%Lh%Ph%Th%Xh%\h %`h(%dh0%hh8p%lh@`%phHP%thP@%xhX0%|h` %hh%hp%hx%h%h%h%h%h%h%h%hp%h`%hP%h@%h0%h %h%h%h%h%h%h%h%h %h(%h0%h8p%h@`%hHP%hP@%hX0%h` %hh%hp%hx% h%h%h%h%h% h%$h%(hp%,h`%0hP%4h@%8h0%<h %@h%Dh%Hh%Lh%Ph%Th%Xh%\h %`h(%dh0%hh8p%lh@`%phHP%thP@%xhX0%|h` %hh%hp%hx%h%h%h%h%h%h%h%hp%h`%hPjjRtkhdsaDtHt PCE$u T$RU @RPp;#PjURQt`|$уP D$td$у`tƒ 3fd$f T$tfd$f L$l$YZ]ÐUE PEPj{ EEUE PEPjk EEUE PEPj[ EEUjjEPE PEPjCEEÐU졄PPpPjhxhshP"jjÐU EtÐUjEPEUPEUPÐU]EU H+J Ѝ++ًEU @+BÉEE]ÐUhEPEEÐUE@4tj EP/fEjEP/fEEÐUEU @BEU @BEU @BEU @BEU @BEU @ fB EU @ fB EU @fBEU @BEU @BEU @BEU @ B UM B$A$B(A(UM B,A,B0A0EU @4B4ÐUEt E@EEEU @;BEU @;BurEPE @;u`EE P E@ ;uE PE@;uU3EP E @ ;u;E U@4B4ttϋE8EE@8EEPEt EUPEEEÐUEjEPfEUjДP EEUEPEPP EEuaE u5d/EEtEPEPEE EEUB8EUUE,PB,P~UMB,A,B0A0UE$PB$Pp}UMB$A$B(A(EPE@ ЋEPEUHJEHEUHJEHE@4E@4tEU@ fB EU@fBE@4t EU@ B EUH4 J4EH4EUHJEHE@4taEU@;B rSEU@8BUjДP2UfB EP4EP4jEPEE ujEP@/UjДPEEEÐUEE;E:EU@BEEEU@BEE"UfBEE"UfBEEtEj@P2ЋEPEEKEj@P ЋEPEE#Ej$PRjPЋEPEEEj,PjPЋEPEEE@ UfBEEE@UfBEEE@UBE@EiE@UBE@EME@UBE@E1t@jPUfBEE"jPUfBEEjh" jPЋEPEEj"PkЋEPEE" ȍ++jQ-ЋEPEEFE@EE.UBE@EUfBEEE@EEUE PjPEPE Phxj0jjUE P}Bw$B}P}2&}C끐&+'"iY$C)#};$,C%$8CE@EE;EEEEh?@?A0@L@h@?>A?@>A$?AAA@@@A0AlAAAAAAAUDEEt@"EEjhx"u]jEPEEEPhxh t"tjhx"t"E"@8"jhx]"ujhD+" ttjjEPEPB PAPLEjEPK)"@"t";P{jh"ttjjh"j@PBPEtt "H BEEEE;"UЋ"ЋB$uHUЋ"ЋB$pẺEċE@E̋EĉEE;EQt@t:UЋ"jB(PСt@"UЋ"jjjEPh"BPE܋E;E}UЋ"ЍB(EEP"EP"EEԉE؋E+5"EЋEЃtgE+5"‰EE"EЉEEPEP/u/2@u"EPEP u @tދE@EE;"+"tE@="‰Eȡ""""eÐUEjh'"@4%uBjEPEEEPhh% "@4%tj"P}"@4"@8"yÐU EjhЂwjEPyEEEPhЂh jEPIEE=jUjДP EEEEEE@4t_EU+P,;~JEU@8BUfB EP4EP4E"P8E"E@ErEU+P,;EU@,+B$;~KEU@8Bjhx7E"P8E"jhx$E@EE8EE@8EEUjДPE@EE="tjh!"t+"EE@8"jEP6"uÐU"tE"EE @+"EE|E@t?"@4t"E"tE @ EE@jPUEEUPEU@ BEU@BEU@BEU@ BUfB UBE@E@E@ E U@B$E U@B(UMB$A,B(A0E@jP%EE@"E"EE@jPZ+"EPE+"EE@} E@EU;P~ E@EE@jP%?tZEP4EP4EU@fB E@jP% uEP4EP4EUPEP EEEU@fB EU@fBZE@jPUfB E@jPUfBUfB UfB>EP4EP4+E@}t뽐WN먋E@u*E}"E؋U;|E؋UMD A"P4"P4"@8"jhOÐUjjjhJj"PE j@PBPhxj$ jď"P2ÐUD@<DžDžDžjjjjjjP j jP DžDžDž "hE PEPe tG'"?ththE PEP uHأȏ"̏"̏"t̏"@-u 0tj4P Dž@tjDPtjPPtjTP`tjdPftxNЈtgbtShxhxh`" jj|+jP}t뼃tt밡ptjtPЃj:ԃPtYB@@t/PhyPl Phhԃ@tjԃPtH:Bjh jP"``Џ"`u2j@PSPh yh`"p jjjjhh(yhyЏ"PtBjPIs#h4yhxh`" jj t\j$Pԏ"ԏ"t=ԏ";| ԏ";~#hLyhxh`" jj! tj$P "0tLj4Puppr pv#h`yhxh`"% jjtjP t0jjh"h"hlyPKu ""Pt!jjh"h"hlyTPjjPPjPt%htyhxh`"E jj>PBBBB jPtjP"`jdPb```uf@tj@PF\y\jj\PdPhyh`"<jjE+"""}"jPa``"`u:"";EE j:Pu4B@jjj }2j@PPhyh`" jj"Ћ"ЋB"Ћ"B$"Ћ"ЋBBBB "Ћ"B(j/PkPB@j/P*B@Ab"Ћ"B$"@"-L@m} t␐mtrtԋ@t~jjPPjPt"Ћ5"SBFBFBFB F jPv"Ћ"jBPPr t2%j@PZPhyh`"w jjjjPPPPt%"@Phyh`"% jj"Ћ5"SBFBFBF B FjPh"Ћ"jBPPt t2j@PLPhyh`"i jjtH/BtH/BH:B@"\"@"\`;E PPh j@PDPhyh`"a jj=h@"hzhz9 hP"hzhz" h`"hzhz *jjbtې0jjjjjhP"jjjjjh`"ď"ď"PhzP Ph̏"uOjP``̏"`u"Ph zjh jj̏"@-uKP̏"PI""u"Ph8zj jjXjPhȏ"PP̏"P""u"PhPzj jj"tTj"Pjjh"hhP}#j@PPhhzjK j"PDž;tu'"@뙐| ""u"Ph|zj jjttjjjPP"Pu8j"PjjPRhzjjj]P"Pxu,j"PSPhzj jjhzj PpPj< Dž=}7jДP@=|"jh! ``"`uq""H`H`\\9 X"XP8Xu/j@PPh {jz jj"@8"XHXTTl""P8""jh"@9p"t"x"|"Džljh"ejlPjb jh"ja t/j@P Ph{ji jjhxh4{jI @tbjDPujhD{ t9^j@PjjPDPhH{jjj-jjԏ"ԏ"jPDžԏ"~^jPuhԏ"Pt/j@PPhd{j> jjjjjPPh "Jt/Mj@PPh{j jj&j "Pԏ"@ԏ"@jj}/j@PPh{j] jj@ PB Pt=sj@PjjPC Ph{jjjD@PBPYt=j@PKjjPCPh{jjjhzЏ"P``"`u%j@PPh{jE )ď"Ph{"P j"Pď"Ph|j jPP̏"Ph |j Ph0|j @tD` |``td\ |\tX|X=tj " ԏ"XPPP\P`P"P"PP"P"PBPQPSpP"P"PVGPPPPPȏ"Ph@|j hDž;"DDžm8Džr,Ћ"ЋB$ttȋЋ"jrjjPh|hPHЋ"jrU؋Ћ"BjPЋPPRSH@Ph|jK @;""jP*""jP"jh"j Džh"t1"+"+u"u"@4u$djdPjjjjD"h|j9 "jhDjh5"%"+"+ ""@4jЏ"P^h}jo EED@<ÐUUE 3fUEEEEHEEEEtWE%tE"E3‰EEEEEfEEEEHEEEEuEfEEÐUfEE EE HE EEEtNE@"E3U"E3fUE@EE EE HE EEEuEfEEÐU$]h|~hp~EEt`jEPjEPjP PjS jjEPjjEPjEP-jjg33]jSf"EE=}>EPRUfU"UE"E@EE=|EE=}k4EE sss]EEE"EEU""UE"E@EE=|]ÐUjh<N")"t+"";"vE@ Kj"P{EEu+EEE "EEE;$"s0EUPEEE("EE@EE;$"rС$"UHBE"P""$"""""EUPE,"+("EP E0"PE0"E@ EW0"EE@uE@EE@tE@UHB"H"EEEPEEjh<EEEÐU jh<0"E0"EE@;Ew E@ ;Es%EEE@EE@;EwE@ ;ErۋEEEPEM E@U@B"@"E@;$"uJEU@BjEPz"+$"""+$"""+""jh<ÐUE $"$" "E("("$"," ",""E"EEÐUTET@TEEEEEEEEUE=}xEUM4"E@EEUDtU:4"E@EU4"E@EEUt E=|Th4"E PEP EXth~h`"TEEUtjEUDt Network interface name -f Filter expression (see tcpdump manual for details) -s How often scan for expired flows [5] -g Fragmented flow lifetime [30] -d Idle flow lifetime (inactive timer) [60] -e Active flow lifetime (active timer) [300] -n NetFlow version for use (1, 5 or 7) [5] -a
Use
as source for NetFlow flow -x [:] Workaround for SNMP interfaces indexes [0] -b Memory bulk size (1..%u) [%u] -m Memory limit (0=no limit) [0] -q Pending queue length [100] -B Kernel capture buffer size [0] -r Real-time priority (0=disabled, %d..%d) [0] -t Produce nanosecond delay after each bytes sent [0:0] -S Snaplen [256] -K Link layer header size -k Don't exclude link layer header from packet size -c Directory to chroot to -u User to run as -v Maximum log level (0=EMERG, ..., 6=INFO, 7=DEBUG) [6] -l <[dst][:id]> Log destination and log/pidfile idetifier [1] remote:port Address of the NetFlow collector 1.1fill(): Unknown format at %x[%d]: %dpcap_loop() terminated: %sIllegal %s NetFlow version[%s]malloc(): %s %s/%s.pid/var/runpending queue lengthrealtime prioritybulk size%d:%dsource addressgetpwnam(%s): %s Unknown usersocket(): %s bind(): %s Error in collector #%d parameters connect(): %s fork(): %s/dev/nullrw[%ld]pcap_lookupdev(): %s pcap_open_offline(): %spcap_open_live(): %ssetsockopt(): %sUknown data link type %d. Use -K option.pcap_compile(): %s. Filter: %spcap_setfilter(): %sFilter expression is empty! Are you sure?mem_alloc(): %spthread_sigmask(): %sStarting %s....could not chroot to %s: %spthread_attr_setschedpolicy(): %spthread_create(): %ssetgroups: %ssetregid(%u): %ssetreuid(%u): %sCan't create pid file. fopen(): %s%ld pid: %dinterface: %s, datalink: %s (%d)filter: "%s"options: p=%d s=%u g=%u d=%u e=%u n=%u a=%s x=%u:%u b=%u m=%u q=%u B=%u r=%u t=%u:%u S=%d K=%d k=%d c=%s u=%s v=%u l=%u%s%scollector #%d: %s:%u/%s/%cSIGTERM received. Emitting flows cache...Done.NULLEN10MBIEEE802ARCNETSLIPPPPFDDIATM_RFC1483RAWSLIP_BSDOSPPP_BSDOSATM_CLIPPPP_SERIALPPP_ETHERC_HDLCIEEE802_11LOOPLINUX_SLLLTALKPRISM_HEADERIP_OVER_FCSUNATMARCNET_LINUXENCFRELAYIEEE802_11_RADIOPFLOGLINUX_IRDAAPPLE_IP_OVER_IEEE1394IEEE802_11_RADIO_AVSUNKNOWN/dev/randomrWrong parameters Missing required option Option `-%c': %s require parameterrepeat not allowed[%s]: %s%s%s%s EMERGALERTCRITERRWARNINGNOTICEINFODEBUG111122&262F2V2f2v22222222233&363F3V3f3v33333333344&464F4V4f4v44444444455&565F5V5f5v55555555566&666F6V6f6v66666666677&767F7V7 Hs ds   )l  `L```,`$oo)o..o`o``>@P7'XMVCXMVCXMVC<,aBbcdefghiKklmnpqrSstuvxfprobed} $},}4}<} D} H} P} \}`}l}x}2}3}h}i }l}q}r}w}z}{ }}m ~k~X`[ ~u ~(~4~X`[L~d~l~PCG GM   *#)#)#)#+#&'*#   )# *#+#    0,60 \n4XM  (08Ll )*, . . 1 `7 Hsdsss@$| !""D:HMSP ^j$u~sp8  8  8  8( ujp~suj,~su"j$~su"j<~su4"jT~su4"j\~s""06'5:6@m I@2T7[n_ d{ 9 "@4*02P6 33! < *4"I("gЂ"\""""i 'xC4OP3V"wJ  5@`2204(3"6<Q2Wn(vl 7{ @"r @6p45"" /p363>"\"a 3f5x6}ď"Ј$$4pj 2$$3""^Hs$">\ Q o \rPC ~8"D6`4ds, *4/3p68tQLc "ysP5"<" 7G. @3`: '"J6&i2}1`6 "9< 76X," 4 ", M 5W @9" b 2k " 1 pr  5 5 @7 @i  " 4 T6 T o  4 p4 "  " " @ `7 6 05 3$ ? _ G p 6y " "  ԏ"$ 2 2 " 2 607 "D up9( U "c 4k 3r " 0" 5 4 4 1@" 6 9M " ȏ" 03$!. >  3 P7"K "m  MS l 2 " ̏" 6 5 p2@52:B "3+1 E\P2i`3n"N2 6"34"5.Џ"K"i|p0; u@|P4@r/ 5 1"462`5p5fprobecrti.scrt1.ocrt1.s__get_exit_frame_monitor_ptr__do_exit_code_ptrfsr.strap_tablevalues-Xa.cDdata.dataBbss.bssDrodata.rodatafprobe.cfstatlstat_xmknodnetflow.chash.cmem.cmy_getopt.cmy_log.ccrtn.s_END__START_.XAKk4DpcWMLOl$t.sig_mask.XAKk4DpcWMLOl$t.off_tlinet_ntoapthread_mutex_initfcntlmem_freefprintfmy_getoptmem_init.XAKk4DpcWMLOl$t.parms__1cG__CrunMdo_exit_code6F_v_getuptime.XAKk4DpcWMLOl$t.pidfilefreopen.XAKk4DpcWMLOVAu.NetFlow7_Flow.XAKk4DpcWMLOl$t.inactive_lifetimeselectfreeaddrinfostrlenput_into.XAKk4DpcWMLOVDu.my_log_indent.XAKk4DpcWMLO1Bu.element_size.XAKk4DpcWMLOl$t.scan_interval.XAKk4DpcWMLOl$t.scan_mutex.XAKk4DpcWMLOFBu.crc16_table.XAKk4DpcWMLOVAu.NetFlow5_Header.XAKk4DpcWMLOl$t.peerstotal_elements.XAKk4DpcWMLOl$t.emit_counthash.XAKk4DpcWMLOl$t.emit_mutexpcap_geterrmemset.XAKk4DpcWMLOl$t.emit_rate_bytespcap_callbacksigemptyset_GLOBAL_OFFSET_TABLE_pthread_mutex_lockhtonlsetsid.XAKk4DpcWMLOl$t.verbosity_DYNAMIC__environ_lockpcap_loop.XAKk4DpcWMLOl$t.pw.XAKk4DpcWMLO1Bu.limit_memory.XAKk4DpcWMLO1Bu.mem_mutexhtons.XAKk4DpcWMLOVAu.NetFlow5_Flowmem_alloc__fsr__iobmy_logvsnprintf.XAKk4DpcWMLOl$t.bulk_quantitypcap_open_livepthread_setconcurrencytotal_memory.XAKk4DpcWMLOl$t.pcap_handle.XAKk4DpcWMLOl$t.unpending_timeoutstrchrsprintf.XAKk4DpcWMLOl$t.pending_tail_endkillpthread_creategettime.XAKk4DpcWMLOl$t.pidNetFlow1NetFlow5pcap_filenohash_init_lxstatNetFlow7_environmalloc.XAKk4DpcWMLOl$t.start_time_offset.XAKk4DpcWMLOl$t.emit_rate_delay.XAKk4DpcWMLO1Bu.bulk_quantity.XAKk4DpcWMLOVDu.my_log_names.XAKk4DpcWMLOl$t.sigsemit_thread.XAKk4DpcWMLOl$t.log_dest.XAKk4DpcWMLOl$t.pending_queue_length.XAKk4DpcWMLOVDu.my_log_min_levelsetvbuf_fini.XAKk4DpcWMLOVAu.NetFlow1_Header.XAKk4DpcWMLOl$t.emit_condbindgetpwnam.XAKk4DpcWMLOl$t.netflow__longdouble_used.XAKk4DpcWMLOl$t.thid_lib_versionpthread_sigmask.XAKk4DpcWMLOl$t.npeers_rot.XAKk4DpcWMLOVDu.my_log_flagscloselog.XAKk4DpcWMLOl$t.active_lifetimescan_threadsched_get_priority_maxcopy_flow.XAKk4DpcWMLOl$t.snmp_output_index.XAKk4DpcWMLOVAu.NetFlow1_Flowpthread_cond_signalatexit.XBKk4DpcWMLOl$t.main.threadsremove.XBKk4DpcWMLOlCu.my_getopt.my_opterrusageopenlog__xtol.XAKk4DpcWMLO1Bu.element_table_sizepcap_compile.XAKk4DpcWMLOl$t.killed.XAKk4DpcWMLOl$t.unpending_mutexsetgroupssighandler___errno.XAKk4DpcWMLOl$t.scan_frag_dreg_exitmy_log_closepthread_attr_setschedpolicysetregidsyslogcrc16.XAKk4DpcWMLOl$t.start_time.XAKk4DpcWMLOl$t.emit_timepcap_lookupdev.XBKk4DpcWMLOlCu.my_getopt.flag.XAKk4DpcWMLOl$t.emit_timeout.XAKk4DpcWMLOl$t.scan_cond.XAKk4DpcWMLOl$t.sched_minpcap_datalinkgetpid.XAKk4DpcWMLOFBu.shuffle_table.XAKk4DpcWMLOl$t.flows.XAKk4DpcWMLO1Bu.malloc_sizeoptind___Argv_startsrandsigaddsetgetaddrinfo.XAKk4DpcWMLOl$t.sched_max.XAKk4DpcWMLOl$t.unpending_condunpending_threadsetreuid.XAKk4DpcWMLOl$t.link_layer.XAKk4DpcWMLOl$t.emit_sequence.XAKk4DpcWMLOVAu.NetFlow7_Header.XAKk4DpcWMLOl$t.schedpnanosleep_xstat.XAKk4DpcWMLOl$t.npeers_fxstat.XAKk4DpcWMLO1Bu.mem_index_table_size__fsr_init_valuefree_elementsconnectstrcat.XAKk4DpcWMLOl$t.off_nl.XAKk4DpcWMLO1Bu.rootpcap_setfiltersocketpcap_open_offline__fpstartfclosecmpmtime.XAKk4DpcWMLOFBu.crc16_poly.XAKk4DpcWMLOl$t.promiscsched_get_priority_minfill_get_exit_frame_monitor.XAKk4DpcWMLOl$t.snmp_input_index.XAKk4DpcWMLOl$t.filterpcap_threaddltpthread_cond_timedwait.XAKk4DpcWMLOl$t.sockbufsize.XAKk4DpcWMLOl$t.devfopenpthread_detachpthread_mutex_unlocksigactionntohshash_flowstrerror_PROCEDURE_LINKAGE_TABLE_.XAKk4DpcWMLOl$t.identgettimeofdayatoi.XAKk4DpcWMLOl$t.emit_packet.XAKk4DpcWMLOl$t.link_layer_sizemain.XAKk4DpcWMLOl$t.flows_mutexfread.XAKk4DpcWMLOl$t.flows_emitsscanf.XBKk4DpcWMLOlCu.my_getopt.optstringpthread_attr_init.XAKk4DpcWMLOl$t.pidfilepath.XAKk4DpcWMLOl$t.pending_head_edatafind_etextforkmy_log_openpthread_attr_setschedparamoptargsetsockoptcallocsendchdir.XAKk4DpcWMLOl$t.frag_lifetimechroot%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMIacomp: Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15as: Sun Compiler Common 12.1 SunOS_i386 Patch 141858-03 2009/09/21%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMIacomp: Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15as: Sun Compiler Common 12.1 SunOS_i386 Patch 141858-03 2009/09/21%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMIacomp: Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15as: Sun Compiler Common 12.1 SunOS_i386 Patch 141858-03 2009/09/21%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMIacomp: Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15as: Sun Compiler Common 12.1 SunOS_i386 Patch 141858-03 2009/09/21%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMIacomp: Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15as: Sun Compiler Common 12.1 SunOS_i386 Patch 141858-03 2009/09/21%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMI%Z%%M% %I% %E% SMIacomp: Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15as: Sun Compiler Common 12.1 SunOS_i386 Patch 141858-03 2009/09/21ld: Software Generation Utilities - Solaris Link Editors: 5.11-1.1689+4fprobe.c /var/tmp/fprobe-1.1/src /opt/sunstudio12.1/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c fprobe.c -W0,-xp.XAKk4DpcWMLOl\$t.Xa;g;R=Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15;G=.XAKk4DpcWMLOl$t.;backend;raw;cd;DBG_GEN 5.2.7statp88Uyy_path_buf intcharunsigned longdev_tlong  ino_tmode_tnlink_tunsigneduid_tgid_t$ off_ttime_t timespecm tv_sec0# tv_nsec#=timestruc_tblksize_tblkcnt_t    stat st_dev# st_pad1# st_ino# st_mode# st_nlink# st_uid# st_gid# st_rdev#$ st_pad2#( st_size$#0 st_pad3#4 st_atimm#8 st_mtimm#@ st_ctimm#H st_blksize#P st_blocks#T st_fstype#X st_pad4#hlstat88Uy49_path_buf 4fstat88Uyzy_fd_buf mknod88Uy_path_mode _dev DLTA linktypey# offset_link# offset_nl# offset_nl_nosnap# descr# lS  dltAO getopt_parms  name# flagy# county# arg# fparms f parmsfilterscan_intervalfrag_lifetimeyinactive_lifetimeyactive_lifetimeybulk_quantityppending_queue_lengthunsigned shortuint16_t  NetFlow$  Version# HeaderSize# MaxFlows# FlowSize# SeqOffset# HeaderFields# HeaderFormat# FlowFields# FlowFormat# netflowtverbositylog_destlink_layer_sizeyunsigned char uint8_t  __pthread_mutex_flag1# __pthread_mutex_flag2# __pthread_mutex_ceiling# __pthread_mutex_type# __pthread_mutex_magic#  __pthread_mutex_pad#uint32_t M __pthread_ownerpid # __pthread_lockword #unsigned long longM upad64_t __pthread_mutex_lock64# __pthread_mutex_lock32 # __pthread_mutex_owner64c # _pthread_mutexG __pthread_mutex_flags,# __pthread_mutex_lockr # __pthread_mutex_datac # pthread_mutex_tunpending_mutexG ,  __pthread_cond_flag| # __pthread_cond_type# __pthread_cond_magic# _pthread_cond9 __pthread_cond_flags # __pthread_cond_datac # pthread_cond_tunpending_cond9 -scan_mutexG /Ђscan_cond9 0emit_mutexG 4xemit_cond9 5  ident 8emit_timeouty=unpending_timeouty= passwd$ pw_name# pw_passwd# pw_uid# pw_gid# pw_age# pw_comment# pw_gecos# pw_dir# pw_shell# 7 pw ?usageB9<9Usighandlerv@9b9U8 ysigugettimep99Ux  nowt  Time sec0# usec#x suseconds_t timeval tv_sec0# tv_usec #cmpmtime99U0$ t1 t2 getuptime9:U V thash_flow:R:UHflowhash_t s_b1# s_b2# s_b3# s_b4# s_w1# s_w2#+ S_un_b# S_un_w# S_addr # in_addrH S_un#M Flow<, sip+# dip+# proto# id# sp# dp# tos# tcp_flags# pkts# size# sizeF# sizeP# ctimex #$ mtimex #, flagsy#4 nextH#8copy_flow`:.;UtHsrcHdst Cfind0;<UHHwhereHwhat prevflowppHput_into <>UyHflowyflag retyhflownHflowppCfill=>BUyfields<format< Hflow<p<iy>voidemit_threadPCGUflowHpnow timeout=iyretysentysizeydelayypeer_rot_curypeer_rot_workyunpending_thread9 GGUunow :timeout=;scan_threadhGIUiylflowHmflowppmnowx ntimeout=opcap_callbackJMUuseless5pkthdr ?packetnltlflowHoff_fragypsizeyC u_charbpf_u_int32 pcap_pkthdr0 ts # caplen# len# 0: uchar_tushort_t ipip_hlD#ip_vD# ip_tosD# ip_lenR# ip_idR# ip_offR# ip_ttlD# ip_pD# ip_sumR# ip_src+# ip_dst+#apcap_threadMMUmainN2iUyzyargczargv errbufbpf_filterdhostdportlhosttypelog_suffixcyiysockymemory_limitylink_typeylink_type_idxysnaplenyhintsres2saddrXtattrsigactthreadstimeout BC u_intu_short bpf_insn code# jt# jf# k# bpf_program# bf_len# bf_insns#socklen_tsa_family_tV  sockaddr sa_family3# sa_dataE#V addrinfo 2 ai_flagsy# ai_familyy# ai_socktypey# ai_protocoly# ai_addrlen## ai_canonname# ai_addr# ai_next2#in_port_tX  sockaddr_in sin_family3# sin_port7# sin_addr+# sin_zeroG# _pthread_attr __pthread_attrp#pthread_attr_tyt  pid_tsigvalL sival_inty# sival_ptr#r __uid# __value#clock_t  __utimer# __statusy# __stimer#  __killL# __cld#ctid_tzoneid_t@ __pid # __pdata# __ctid# __zoneid#caddr_t  __addr# __trapnoy# __pc@# __fdy# __band#short  y(  XQ __faddr@# __tstampm# __syscall# __nsysarg# __fault# __sysarg# __mstate#0yint32_t x __entityQ#t __pad# __proc# __faultN# __file# __prof# __rctl_# siginfo+ si_signoy# si_codey# si_errnoy# __datax#  G!y!+!0x _handler# _sigactionG#  __sigbitsx#sigset_ty  sigaction  sa_flagsy# _funcptrL# sa_mask# sa_resv#( killedy<"pid ;ď"pidfilepath:Џ"  __FILEN _cnty# _ptrl# _basel# _flag # _magic # __orientation# __ionolock#  __seekable#  __extendedfd#  __xf_nocheck#  __filler#  qFILEN pidfileY 9"flows_emitH6"scan_frag_dregH2"pending_tailH1"pending_headH1""G  #flows_mutex *"H.!#flows!)sigsy' peer,! socky# addrX# laddrX# typey#$ seq #(W!peers!&"npeers_roty%"npeersy%"sched_maxy$sched_miny$y 2"  sched_param$o" sched_priorityy# sched_pad!"#schedp2"#ԏ"sig_mask""pthread_tthid"! "$pcap"pcap_t"pcap_handle" " #emit_packet""emit_timex "emit_rate_delay"emit_rate_bytes"emit_sequence "emit_count"off_tly "off_nly "start_time_offset "start_timex  link_layery"snmp_output_index"snmp_input_index"sockbufsizey"dev̏"promiscȏ"%mem_inity$!!!&mem_free$!'mem_alloc(hash_init%hash5%!%!y5%f%my_getoptyk%!y!:%!?%k%&my_log%!!p%)&my_log_open%!!!y%%_xmknody%!%!%!!y%%_lxstaty#&!%!%!y(&%_xstatyV&!#&!-&!y%_fxstaty&!V&!y!&freeaddrinfo&!2&&&2%getaddrinfoy&!&!&!&!&y'___errno&%pthread_setconcurrencyy-'!y  =7'%pthread_cond_timedwaityu'!-'!2'!<'%pthread_cond_signaly'!-'%pthread_mutex_unlocky'!2'%pthread_mutex_locky'!2' _pthread_mutexattr"( __pthread_mutexattrp#'"(%pthread_mutex_inityW(!2'!'(%pthread_detachyy(!~(*(!(%pthread_createy(!y(!(!(!2"(%pthread_attr_setschedparamy)!(!(%pthread_attr_setschedpolicyyE)!(!y%pthread_attr_inityj)!(%sched_get_priority_miny)!y%sched_get_priority_maxy)!y) %__posix_getpwnam_ry*!)! !!y!)%__posix_getpwuid_ryA*!! !!y!)A*%getpwnam g*!F*%inet_ntoa*!+%sockety*!y!y!y*%setsockopty*!y!y!y!*!yssize_t*%send*#+!*!*!!*V#+%connectyR+!y!(+!VR+%bindy~+!y!W+!%ntohs+!%htons+!%htonl +! "%pcap_filenoy+!+%pcap_datalinky,!+,%pcap_compileyQ,!+!,!,!y!%pcap_geterrp,!+%pcap_setfiltery,!+!,, , ,!l!,!,,%pcap_loopy,!+!y!,!l,%pcap_open_offline",-!,!,,-%pcap_open_live"l-!1-!y!y!y!,%pcap_lookupdev-!-%__posix_sigwaity-!-!&-%pthread_sigmasky-!y!-!-%sigemptysety.!-%sigaddsety=.!-!y=.%sigactionys.!y!B.!G.%killy.!!y.%strchr.!.!y.size_t%strlen..!.%strerror/!y/%strcat//!! /%memsetS/!!y!%__posix_ttyname_ry/!y!!%__posix_getlogin_ry/!!y+setsid %setreuidy/!!%setregidy/!!/%setgroupsy+0!y!0+getpid +fork I0%chrootym0!N0m0%chdiry0!r00  fd_set0 fds_bits0#0 %selecty0!y!0!0!0!00%__posix_ctime_r+1!0! tm$1 tm_secy# tm_miny# tm_houry# tm_mdayy# tm_mony# tm_yeary# tm_wdayy# tm_ydayy# tm_isdsty# +11%__posix_asctime_r1!1!=1=%nanosleepy)2!1!2%gettimeofdayyN2!0!%malloch2!&exit|2!y|2%atoiy2!22%snprintfy2!!!2)22%sscanfy3!2!2)3%sprintfy.3!!3)q33%fprintfy^3!.3!83)%setvbufy3!.3!!y!33%freopenY 3!3!3!Y 33%fopenY 3!3!3%fclosey 4!.3 4,removey!4Enetflow.c /var/tmp/fprobe-1.1/src /opt/sunstudio12.1/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c netflow.c -W0,-xp.XAKk4DpcWMLOVAu.Xa;g;R=Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15;G=.XAKk4DpcWMLOVAu.;backend;raw;cd;DBG_GEN 5.2.7:unsigned short=uint16_tlongOu^NetFlow1_Headerf,O ^NetFlow1_Header,NetFlow1_Flowf6O&^NetFlow1_Flow6NetFlow5_Headerf*\O:^NetFlow5_Header)*\NetFlow5_Flowf6nO(^NetFlow5_Flowt6nNetFlow7_HeaderfMO^NetFlow7_HeaderMNetFlow7_FlowfWO*^NetFlow7_Flow Wunsigned O NetFlow$ Version7# HeaderSize7# MaxFlows7# FlowSize7# SeqOffset7# HeaderFields7# HeaderFormatC# FlowFields7# FlowFormatC# NetFlow1HoЈ NetFlow5H{ NetFlow7H(hash.c /var/tmp/fprobe-1.1/src /opt/sunstudio12.1/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c hash.c -W0,-xp.XAKk4DpcWMLOFBu.Xa;g;R=Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15;G=.XAKk4DpcWMLOFBu.;backend;raw;cd;DBG_GEN 5.2.7crc16@iiUcrcval iunsigned shortuint16_tunsigned charuint8_tinthash&ifjU.p%size% hash,hash_tvoid&hash_initCpjkUrndFiFjFmFrnddevGunsigned __FILE _cnt# _ptr# _base# _flag# _magic# __orientation#  __ionolock#   __seekable#   __extendedfd#   __xf_nocheck#   __filler#  FILElong  crc16_table"  shuffle_table"crc16_poly"fcntlHcharH__posix_ttyname_rP__posix_getlogin_rPpid_tgetpid__posix_ctime_rPP tm$ tm_sec# tm_min# tm_hour# tm_mday# tm_mon# tm_year# tm_wday# tm_yday# tm_isdst# __posix_asctime_rPPtime_ttimesrand randfileno6&size_tfread;u6;;HHuHfopenzfclose2Mmem.c /var/tmp/fprobe-1.1/src /opt/sunstudio12.1/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c mem.c -W0,-xp.XAKk4DpcWMLO1Bu.Xa;g;R=Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15;G=.XAKk4DpcWMLO1Bu.;backend;raw;cd;DBG_GEN 5.2.7unsigned short5uint16_tunsigned charVuint8_t__pthread_mutex_flag1G#__pthread_mutex_flag2g#__pthread_mutex_ceilingg#__pthread_mutex_typeG#__pthread_mutex_magicG#longg-Q__pthread_mutex_pad#unsignedQuint32_t__pthread_ownerpid]#__pthread_lockword]#unsigned long longupad64_t5__pthread_mutex_lock64-#__pthread_mutex_lock32l#__pthread_mutex_owner64# _pthread_mutex__pthread_mutex_flagsu#__pthread_mutex_lock#__pthread_mutex_data#5pthread_mutex_t mem_mutex< mem_alloc%lmUJB iQ& mptrO' iptr( eptrJ*void B T MemnextO#freeQ#firstJ#lastJ# Jmem_index_t  mem_freenmnUJeptrm iptro mptrOp pptrp Omem_initnoUooQelementQbulk Qlimitint malloc_sizeQ"" element_table_sizeQ!," mem_index_table_sizeQ  "total_memoryQ" limit_memoryQ" bulk_quantityQ$" element_sizeQ("free_elementsQ"total_elementsQ" rootO0" 5pthread_mutex_unlockopthread_mutex_locko char __posix_ctime_r" tm$tm_seco#tm_mino#tm_houro#tm_mdayo# tm_mono#tm_yearo#tm_wdayo#tm_ydayo#tm_isdsto# " __posix_asctime_r o___errnofreeJcallocJQQJmy_getopt.c /var/tmp/fprobe-1.1/src /opt/sunstudio12.1/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c my_getopt.c -W0,-xp.XAKk4DpcWMLOlCu.Xa;g;R=Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15;G=.XAKk4DpcWMLOlCu.;backend;raw;cd;DBG_GEN 5.2.70my_getopt o7rU   argc"argv pparmsc i p flag Tmy_opterr Xoptstring}4"intchargetopt_parmsp name# flag # count # arg# 'long  u getopt    unsigned charunsigned__FILE _cnt # _ptr# _base# _flag# _magic# __orientation# __ionolock#  __seekable#  __extendedfd#  __xf_nocheck#  __filler#   fprintf    __posix_ttyname_r &    __posix_getlogin_r Q  uQ __posix_ctime_r V tm$ tm_sec # tm_min # tm_hour # tm_mday # tm_mon # tm_year # tm_wday # tm_yday # tm_isdst # __posix_asctime_r ! >}my_log.c /var/tmp/fprobe-1.1/src /opt/sunstudio12.1/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c my_log.c -W0,-xp.XAKk4DpcWMLOVDu.Xa;g;R=Sun C 5.10 SunOS_i386 Patch 142363-01 2009/07/15;G=.XAKk4DpcWMLOVDu.;backend;raw;cd;DBG_GEN 5.2.7!char;longC_Hmy_log_namesP\C Hmy_log_namesz\ my_log_open@rorU Cindent min_level flagsunsigned my_log_close$przrU my_log)rFsU level( format( ...(args*msg+msg_prefix, ;voidva_list;H;@H?my_log_flags<"my_log_min_level8"my_log_indentC4" ;Tintvsnprintf^CY ;snprintf^C unsigned char__FILE_cnt^#_ptr#_base#_flag# _magic# __orientation# __ionolock#  __seekable#  __extendedfd#  __xf_nocheck#  __filler#   ;fprintf^ closelog ;syslog^ ;openlog^^6 /var/tmp/fprobe-1.1/src/usr/include/sys./usr/include/netinet/usr/local/include/pcap/usr/include/isofprobe.cstat_impl.hstat.htypes.hstdlib.hstdio.htime_impl.hfprobe.hmy_getopt.hnetflow.hint_types.hpwd.htime.hhash.hin.hpcap.hbpf.hip.hnetdb.hsocket_impl.hbyteorder.hsignal.hsiginfo.htime.hselect.hstdio_impl.hstdio_iso.hsched.htime_iso.hp8v88 888 888 888 99.9 :9 @9C9H9 U9 X9}`9 p9v99 9 9 999 99 : ::8: L: `:c:o: {: : : : : : : : : : : ;  ; ,; 0;6;G; S;; ;; ;; ;w; ; ;o<< <  <&<-<?<Z< h< < < < < <<< < = = 8= J= `= r= = = == = == = = > &> A>M> \>m>> > > >>>> > > >> ? ?? ? $?0? 9? @?Y? b? h?? ? ?? ? ?? ? ?@ @ @"@ +@ 0@=@ D@ L@Y@ `@ h@u@ |@ @@ @ @@ @ @@ A A A )A 0A^A gA lAvA A A A A AA A AA A AA BB|BB PCVCdCuC |CC C C C C C CzC C DD D /D ?DjD xD D D D D D D  E 0E XE wE E E E F 4FBF KF YF aF qF xF F FbF#F G GG  G&G-G K bK {K KK K K K K L L :L IL XLpL xLL L LL L L L L LM_,M(OM bMxM M MMM M M MNN /N 9N JN [N nN N N N NN N N NN{N O -O 7O YO |O O O O O P  P P P  P$P/P 4PKP \PrPP P P P P Q +QNQ tQ Q Q Q R  R R )R @R LRVR kRR R RR R R R S S *SMS WS }S S S S S S S  T 9T JTiT sT T T U U!U 0U tU U U U U V 4V @V hV V V V W 8W ^W yW |WWW W WWuWW X \X mXX X X Y Y *Y jY {Y Y Y Y Z 2Z MZGZ>Z Z Z Z ZZ  [ ![ 8[ <[L[sh[[ [[ [ [[ \ \ '\5\ O\ Y\ o\ \\ \ \ \ \ ] 8]N] X] ] ] ] ]|]] ] ] ^ ^ ^ >^ j^ v^ ^ ^ ^ ^ ^ ^ 9_C_R_ x_ _ _ _  ` ` "`zV`d` n` }` ` ` ` ` `` a &a:a Da ma a aaa a a a "b Eb Qb~b b b b bsbb c &c 2c Rc c c c c cd @d Yd id~d d de f f "f $f .f 0fz\ff 8guWgqg g g gg g g h.h ;h Jh Th ^h hh rh |h h h h hnhiijd /var/tmp/fprobe-1.1/src/usr/include/sys.netflow.cint_types.hnetflow.h /var/tmp/fprobe-1.1/src/usr/include/sys./usr/include/isohash.cint_types.hhash.hstdio_impl.hstdio_iso.htypes.htime_iso.h@iFiWi yi i i i ii+i j =jwXj `j pjyjj j j j k 'k 8k Yk ek~vkk k k k k|k /var/tmp/fprobe-1.1/src/usr/include/sys./usr/include/isomem.ctypes.hint_types.hmem.htime_iso.hll-l #l @lGl Sl Xl xl l l l l l}ll l l  m m -m 9m AmJm LmTm sm m m m m m m mmmm m m n  n~!n*n 9nFn Qn _nkn yn n n nn nnn n n n  o oo  /var/tmp/fprobe-1.1/src./usr/include/usr/include/isomy_getopt.cmy_getopt.hstdio_impl.htime_iso.h o&oQo _o o o o o o|opp  p  &III: I  !I/  :  I8 I  4I?  : ;  I!I4I : ;  4I : ;  :  : !I/.?  : ;@ D .?  : ;@ ' D I: ; .?  : ;@ ' ID D D .?  : ;@ ID  I8 .?  : ;@ ID .?  6 : ;@ ' ID D  :  ' D !I"I #!I/$< %.? < ' ID &.? < ' D '.? < ID (.? < D )*' ID +.? < ' ID ,.? < ' ID  DD%$> I: I!I4I : ;  I !I/ I  :  I8 4I?  : ;   DD%.?  : ; @ ' ID I: ;  4I : ;  $> I: I.?  : ; @ D   :  I8 I8 I  !I/.? < ' ID I.? < ' ID &I.? < ' D .? < ' ID  DD%$> I:  :  I8 I !I/  :   :  4I : ;  .?  : ; @ ID  I .?  : ; @ ' D I: ;  .?  : ; @ ' ID 4I?  : ;  .? < ' ID I&I.? < ID .? < ' D .? < ' ID  DD%.?  : ; @ ' ID I: ;  4I : ;  $> I&I :  I8 I  !I/ .? < ' ID  I I8 .? < ' ID  DD%$> II!I4I : ;  I !I/ .?  : ; @ ' D  I: ;  .?  : ; @ ' D  &II: I !I/.? < ' ID I :  I8  I8 .? < ' D .? < ' D .? < ' D /4Sdlt usage sighandler8 gettime cmpmtime$getuptimeVhash_flow,copy_flowtfindput_intofillemit_threadunpending_threaduscan_threadpcap_callbackpcap_thread7main5/4INetFlow1NetFlow5/NetFlow7/x87crc16hash3hash_initl7?6mem_allocmem_freemem_inittotal_memoryBfree_elements_total_elementsmGNAmy_getopt:LBmy_log_open my_log_close'my_log5/4<statlstat>fstatzmknod/4dev_tino_tmode_tnlink_tuid_tgid_t$off_t0time_t=timespecmtimestruc_tblksize_tblkcnt_tstatDLTfgetopt_parmsuint16_tNetFlowuint8_t, uint32_t c upad64_tr _pthread_mutexG pthread_mutex_t _pthread_cond9 pthread_cond_t7 passwdx Time suseconds_t timevalhash_t+in_addrMFlowu_charbpf_u_int32pcap_pkthdrDuchar_tRushort_taipu_intu_shortbpf_insnbpf_program#socklen_t3sa_family_tVsockaddraddrinfo7in_port_tXsockaddr_in_pthread_attrpthread_attr_t pid_tsigvalLrclock_tctid_tzoneid_t@caddr_tNQint32_t_xsiginfoLsigset_tsigactionq__FILEN FILEW!peer2"sched_param"pthread_t"pcap_t'_pthread_mutexattr*ssize_t.size_t0fd_set+1tm'/4IOuint16_tHNetFlowmx8uint16_tuint8_thash_t__FILEFILEpid_ttmtime_t;size_t7?6Guint16_tguint8_tu-]uint32_tlupad64_t5_pthread_mutexpthread_mutex_tTMemmem_index_t"tm1mGN'getopt_parms__FILEtm%LBva_list__FILE/4parmsparmsfilter scan_interval)frag_lifetimeEinactive_lifetimeeactive_lifetimebulk_quantitypending_queue_lengthnetflowverbositylog_destlink_layer_size] unpending_mutexN unpending_condl scan_mutex scan_cond emit_mutex emit_cond ident emit_timeout unpending_timeout pw.threads(killed>pidQpidfilepath^ pidfileu flows_emit scan_frag_dreg pending_tail pending_head flows_mutex.!flowsC!sigs!peers!npeers_rot!npeers!sched_max"sched_mino"schedp"sig_mask"thid"pcap_handle#emit_packet##emit_time<#emit_rate_delay[#emit_rate_bytesz#emit_sequence#emit_count#off_tl#off_nl#start_time_offset#start_time$link_layer2$snmp_output_indexS$snmp_input_indexs$sockbufsize$dev$promisc/4IuNetFlow1_HeaderNetFlow1_HeaderNetFlow1_FlowNetFlow1_Flow NetFlow5_Header:NetFlow5_HeaderXNetFlow5_FlowNetFlow5_FlowNetFlow7_HeaderNetFlow7_HeaderNetFlow7_FlowNetFlow7_Flow?x8crc16_tableshuffle_tablecrc16_poly7?6mem_mutexvmalloc_sizeelement_table_sizemem_index_table_sizelimit_memory bulk_quantity'element_size}root3mGNflagmy_opterroptstringhLB_my_log_namesmy_log_namesmy_log_flagsmy_log_min_level8my_log_indent.interp.SUNW_cap.hash.SUNW_ldynsym.dynsym.dynstr.SUNW_version.SUNW_versym.SUNW_dynsymsort.SUNW_reloc.rel.plt.text.init.fini.rodata.rodata1.got.dynamic.data.bssf.bss.symtab.strtab.comment.debug_loc.debug_info.debug_line.debug_abbrev.debug_pubnames.debug_funcnames.debug_typenames.debug_varnames.shstrtab o4oLL ' l l `/")7o))Eo**Ro,,$c ..(o B.. s11x`7`7;~HsHsdsdsssss @@tp$$X|||0N S Q =++2/59%S56: F @P07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000b00000000TRAILER!!!