The ifSpeed field of a generic interface counter in sFlow is 64 bits. The "overlay" definition in print-sflow.c is correct, but the actual extract for printing is using EXTRACT_32BITS rather than EXTRACT_64BITS, which leads to an incorrect report for speed.
Signed-off-by: Rick Jones <rick.jon...@hp.com> diff --git a/print-sflow.c b/print-sflow.c index f27370a..c7e5bc0 100644 --- a/print-sflow.c +++ b/print-sflow.c @@ -316,7 +316,7 @@ print_sflow_counter_generic(const u_char *pointer, u_int len printf("\n\t ifindex %u, iftype %u, ifspeed %u, ifdirection %u (%s)", EXTRACT_32BITS(sflow_gen_counter->ifindex), EXTRACT_32BITS(sflow_gen_counter->iftype), - EXTRACT_32BITS(sflow_gen_counter->ifspeed), + EXTRACT_64BITS(sflow_gen_counter->ifspeed), EXTRACT_32BITS(sflow_gen_counter->ifdirection), tok2str(sflow_iface_direction_values, "Unknown", EXTRACT_32BITS(sflow_gen_counter->ifdirection))); - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.