[tcpdump-workers] [PATCH] pay attention to the enterprise field of the sflow flow and counter record format

2011-04-14 Thread Rick Jones
Thanks to some traces sent my way by Gavin McCullagh, and a comparison against the output of inMon's sflowtool, I can confidently say "Yes Virginia, there is an enterprise other than zero." Which means lest we start trying to decode something as what it is not, we best actually look at the enterpr

Re: [tcpdump-workers] [PATCH] replacement print-sflow.c to include

2011-04-14 Thread Guy Harris
On Apr 14, 2011, at 11:45 AM, Rick Jones wrote: > Cool. BTW, I just found a bug in the print_counters routines - i was > manipulating based on the size of the pointer rather than the struct to > which it pointed. in 64-bit (where I'm running) the two were the same, > but in 32 bit they were not

Re: [tcpdump-workers] [PATCH] replacement print-sflow.c to include

2011-04-14 Thread Rick Jones
On Thu, 2011-04-14 at 11:35 -0700, Guy Harris wrote: > On Apr 13, 2011, at 1:02 PM, Rick Jones wrote: > > > To enable printing of non-expanded samples I've shuffled a bunch of code > > around and created a bunch of smaller routines to more easily support > > printing of both expanded and non-expan

Re: [tcpdump-workers] [PATCH] replacement print-sflow.c to include "non-expanded" counter and flow samples

2011-04-14 Thread Guy Harris
On Apr 13, 2011, at 1:02 PM, Rick Jones wrote: > To enable printing of non-expanded samples I've shuffled a bunch of code > around and created a bunch of smaller routines to more easily support > printing of both expanded and non-expanded counter and flow samples. > I've done simple testing of no