# PaCkAgE DaTaStReAm fprobe 1 211 # end of header 07070100040848000081a40000000000000000000000014e2cc61000000106000000b500010002ffffffffffffffff0000000f00000000fprobe/pkginfoPKG=fprobe NAME=fprobe 1.1 i86pc Solaris 10 VERSION=1.1 PSTAMP=25th July 2011 VENDOR=Slava Astashonok EMAIL=http://sourceforge.net/projects/fprobe/ DESC=NetFlow traffic probes ARCH=i386 CATEGORY=utility CLASSES=none BASEDIR=/ ISTATES=S s 1 2 3 RSTATES=S s 1 2 3 07070100040847000081a40000000000000000000000014e2cc610000001c3000000b500010002ffffffffffffffff0000000e00000000fprobe/pkgmap: 1 211 1 d none /usr ? ? ? 1 d none /usr/local ? ? ? 1 d none /usr/local/sbin 0755 root root 1 f none /usr/local/sbin/fprobe 0755 root root 84596 13003 1311557122 1 d none /usr/local/share 0755 root root 1 d none /usr/local/share/man 0755 root root 1 d none /usr/local/share/man/man8 0755 root root 1 f none /usr/local/share/man/man8/fprobe.8 0644 root root 7414 61902 1311557123 1 i checkinstall 790 2504 1311557136 1 i pkginfo 262 20570 1311557136 07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000b00000000TRAILER!!!07070100040848000081a40000000000000000000000014e2cc61000000106000000b500010002ffffffffffffffff0000000800000000pkginfoPKG=fprobe NAME=fprobe 1.1 i86pc Solaris 10 VERSION=1.1 PSTAMP=25th July 2011 VENDOR=Slava Astashonok EMAIL=http://sourceforge.net/projects/fprobe/ DESC=NetFlow traffic probes ARCH=i386 CATEGORY=utility CLASSES=none BASEDIR=/ ISTATES=S s 1 2 3 RSTATES=S s 1 2 3 07070100040847000081a40000000000000000000000014e2cc610000001c3000000b500010002ffffffffffffffff0000000700000000pkgmap: 1 211 1 d none /usr ? ? ? 1 d none /usr/local ? ? ? 1 d none /usr/local/sbin 0755 root root 1 f none /usr/local/sbin/fprobe 0755 root root 84596 13003 1311557122 1 d none /usr/local/share 0755 root root 1 d none /usr/local/share/man 0755 root root 1 d none /usr/local/share/man/man8 0755 root root 1 f none /usr/local/share/man/man8/fprobe.8 0644 root root 7414 61902 1311557123 1 i checkinstall 790 2504 1311557136 1 i pkginfo 262 20570 1311557136 07070100040852000041ed0000000000000000000000024e2cc61000000000000000b500010002ffffffffffffffff0000000800000000install07070100040853000081ed0000000000000000000000014e2cc61000000316000000b500010002ffffffffffffffff0000001500000000install/checkinstall#!/bin/sh # expected_bits="64" expected_release="5.10" expected_platform="i386" # release=`uname -r` platform=`uname -p` bits=`isainfo -b` # if [ ${platform} != ${expected_platform} ]; then echo "\n\n\n\tThis package must be installed on a ${expected_platform} architecture\n" echo "\tAborting installation.\n\n\n" exit 1 fi if [ ${release} != ${expected_release} ]; then echo "\n\n\n\tThis package must be installed on a ${expected_release} machine\n" echo "\tAborting installation.\n\n\n" exit 1 fi #if [ ${bits} != ${expected_bits} ]; then # echo "\n\n\n\tThis package must be installed on a ${expected_bits} bit machine\n" # echo "\tYour machine is running a ${bits} bit O.S. currently\n" # echo "\tAborting installation.\n\n\n" # exit 1 #fi exit 0 07070100040849000041ed0000000000000000000000034e2cc61000000000000000b500010002ffffffffffffffff0000000500000000root0707010004084a000041ed0000000000000000000000034e2cc61000000000000000b500010002ffffffffffffffff0000000900000000root/usr0707010004084b000041ed0000000000000000000000044e2cc61000000000000000b500010002ffffffffffffffff0000000f00000000root/usr/local0707010004084e000041ed0000000000000000000000034e2cc61000000000000000b500010002ffffffffffffffff0000001500000000root/usr/local/share0707010004084f000041ed0000000000000000000000034e2cc61000000000000000b500010002ffffffffffffffff0000001900000000root/usr/local/share/man07070100040850000041ed0000000000000000000000024e2cc61000000000000000b500010002ffffffffffffffff0000001e00000000root/usr/local/share/man/man807070100040851000081a40000000000000000000000014e2cc60300001cf6000000b500010002ffffffffffffffff0000002700000000root/usr/local/share/man/man8/fprobe.8.TH fprobe 8 "2005-01-29" "fprobe 1.1" .SH NAME fprobe \- a NetFlow probe .SH SYNOPSIS .BI fprobe [\fIoptions\fR] \fIremote:port[/[local][/type]] ...\fR .SH DESCRIPTION .B fprobe \- libpcap-based tool that collect network traffic data and emit it as NetFlow flows towards the specified collector. .SH OPTIONS .TP .B -h Display short help .TP .B -p \fIDon't\fR put the interface into promiscuous mode. Note that even if this option is used, the interface might be in promiscuous mode for some other reason. .TP .B -i \fI\fR Listen on \fIinterface\fR. If unspecified, \fBfprobe\fR will use result of pcap_lookupdev() function. On Linux systems with 2.2 or later kernels, an \fIinterface\fR argument of `\fIany\fR' can be used to capture packets from all interfaces. Note that captures on the `\fIany\fR' device will not be done in promiscuous mode. .br You may use `\fI-\fR' as \fIinterface\fR name to process files produced by \fItcpdump\fR with \fI-w\fR flag. \fBfprobe\fR will read data from \fIstdin\fR. .TP .B -f \fI\fR Filter \fIexpression\fR selects which packets will be captured. If no \fIexpression\fR is given, all packets on the net will be captured. Otherwise, only packets for which \fIexpression\fR is `true' will be captured. .br \fBfprobe\fR use silly IP-packet detection method, so it is bad idea to leave the filter empty. For general use `ip' (-fip) is good filter expression. .br Read .BR tcpdump manual for detailed \fIexpression\fR syntax. .TP .B -s \fI\fR How often scan for expired flows. [default=5] .TP .B -g \fI\fR Fragmented flow lifetime. [default=30] .TP .B -d \fI\fR Idle flow lifetime (inactive timer). [default=60] .TP .B -e \fI\fR Active flow lifetime (active timer). [default=300] .TP .B -n \fI\fR NetFlow version for use (1, 5, 7). [default=5] .TP .B -a \fI
\fR Use \fIaddress\fR as source for NetFlow flow. .TP .B -x \fI[:]\fR Workaround for SNMP interfaces indexes. [default=0] .br The second parameter may be omitted - in this case its value will be equal to the first. .br See BUGS section. .TP .B -b \fI\fR Memory bulk size. [default=200 or 10000] .br Note that maximum and default values depends on compiling options (\fI--with-membulk\fR parameter). .TP .B -m \fI\fR Memory limit for flows cache (0=no limit). [default=0] .TP .B -q \fI\fR Pending queue length. [default=100] .br Each captured packet at first puts into special buffer called `pending queue'. Purpose of this buffer is to separate most time-critical packet capture thread from other. .TP .B -B \fI\fR Kernel capture buffer size (0=don't change). [default=0] .br Increase kernel capture buffer size is most adequate way to prevent packets loss. Unfortunately, at present there is no straight way to set the buffer size throught libpcap, so this option is a hack. Moreover, now this hack take effect only on socket()-based capture mechanisms: it mean that it work on Linux and don't work on BSD systems with their bpf(). .br Note that maximum allowed size of the buffer in Linux limited and generally relatively small, so it should need to change the maximum: sysctl -w net/core/rmem_max=4194304 .TP .B -r \fI\fR Real-time priority (0=disabled). [default=0] .br If parameter greater then zero \fBfprobe\fR will use real-time scheduling policy to prevent packets loss. Note that possible values for this option depends on operating system. .TP .B -t \fI\fR Emitting rate limit (0:0=no limit). [default=0:0] .br Produce \fIN\fR nanosecond delay after each \fIB\fR bytes sent. This option may be useful with slow interfaces and slow collectors. Note that the suspension time may be longer than requested because the argument value is rounded up to an integer multiple of the sleep resolution (it depends on operating system and hardware) or because of the scheduling of other activity by the system. .br See BUGS section. .TP .B -S \fI\fR Snaplen (0=whole packet). [default=256] .br Number of bytes to capture from packet on wire. .TP .B -K \fI\fR Link layer header size. By default \fBfprobe\fR take this information from libpcap, but sometimes obtained size unsuitable for our purpose. It occurs, for example, on trunk interfaces in VLAN enviroment, where link layer header contain additional VLAN header. .br See EXAMPLES section. .TP .B -k Don't exclude link layer header from packet size. By default \fBfprobe\fR counts only IP-part of packet. .TP .B -c \fI\fR Directory to chroot to. .TP .B -u \fI\fR User to run as. .TP .B -v \fI\fR Maximum displayed log level. (0=EMERG, 1=ALERT, 2=CRIT, 3=ERR, 4=WARNING, 5=NOTICE, 6=INFO, 7=DEBUG) [default=6] .TP .B -l \fI<[dst][:id]>\fR Log destination (0=none, 1=syslog, 2=stdout, 3=both) and log/pidfile identifier. [default=1] .br This option allows to select opportune log destination and process identifier. The identifier helps to distinguish pidfile and logs of one \fBfprobe\fR process from other. .br Note that if log destination contains `\fIstdout\fR' (equal 2 or 3) \fBfprobe\fR will run in foreground. .TP .B remote:port/local/type Parameters \fIremote\fR and \fIport\fR are respectively define address and port of the NetFlow collector. .br The \fIlocal\fR parameter allows binding certain local IP address with specified collector. If the parameter is omitted the value (if any) of \fI-a\fR option will be used. .br The \fItype\fR parameter determines emitting behavior. It may be `m' for mirroring (by default) and `r' for collectors round-robin rotating. .br You may specify multiple collectors. .SH EXAMPLES Web traffic trivial capturing: .br \fBfprobe -ippp0 -f"tcp&&port 80" localhost:2055\fR .br Capturing from trunk interface: .br \fBfprobe -ieth0 -f"vlan&&ip" -K18 localhost:2055\fR .br Reasonable configuration to run under heavy load: .br \fBfprobe -fip -B4096 -r2 -q10000 -t10000:10000000 localhost:2055\fR Send packets to collector at 10.1.1.1:2055 and distribute them between collectors at 10.1.1.2:2055 and at 10.1.1.3:2055 on a round-robin basis: .br \fBfprobe 10.1.1.1:2055 10.1.1.2:2055//r 10.1.1.3:2055//r\fR .SH BUGS .B SNMP interfaces indexes and packet direction. .br Unfortunately libpcap don't provide any routing-related information about captured packet, therefore there are no straight ways to determine and distinguish input and output interfaces. However \fI-x\fR option at least can tell that flow was passed through the certain interface. Also you may launch several instances of the program with tricky set of filters to mark out each possible packet direction: .br \fBfprobe -x1:2 -ieth1 -f"ip&&dst net 10.2" localhost:2055\fR .br \fBfprobe -x2:1 -ieth2 -f"ip&&dst net 10.1" localhost:2055\fR .B Slow interfaces and slow collectors. .br There are may be problems with slow interfaces and slow collectors. It effects as emitted packets loss. On the one hand silent non-blocking sendto() implementation can't guarantee that packet was really sent to collector - it may be dropped by kernel due to outgoing buffer shortage (slow interface's problem) and on the other hand packet may be dropped on collector's machine due the similar reason - incoming buffer shortage (slow collector's problem). .br Use \fI-t\fR option as workaround for this issue. .SH SEE ALSO .BR tcpdump .BR pcap(3) .br .BR http://www.cisco.com/go/netflow 0707010004084c000041ed0000000000000000000000024e2cc61000000000000000b500010002ffffffffffffffff0000001400000000root/usr/local/sbin0707010004084d000081ed0000000000000000000000014e2cc60200014a74000000b500010002ffffffffffffffff0000001b00000000root/usr/local/sbin/fprobeELF/4LE4 (! 44opwpwpwpw X'xx/usr/lib/ld.so.1 "#&)+,-./124589:=>?ABEFGHJMPQSTUVWXYZ\]_abcdgjkmoprvwxy{|}  !$%'(*0367;<@CDIKLNOR[^`efhilnqstuz~0z;.A4-TT.^Tze d*$/ f_ 2 ؊"&d,T*".t.5,B+IP4 RT"pL|"DL"b -4"t+<"0B 'L"CD-O*Upwk*~xT,H|$+y8"*4  #0d -zH 0{ N"T"sj {d.X},-"++Ȟ"D+z(5"K-].bt"w$x"$܊",Ȁ$4*b y+D"xk d"="Pg _; kpzX"/,k ć"4,`"Њ":T*Y,.bytkt-D/@"@. <d+2 +*"2.9z3"Xp01< v"z4/.-".p1" *$zj  &)+-G.Pd/Wpa ]\"u,z(zԊ"P} , Dz( ,6 |"K P"j yr "y  / . + T- P? D" $. D Ƈ"1 *; "Y $*` D*h   .zT/ F  l"Z1( Ğ" D, + " $-$ $,+ ,= z` 1M i D.O"!p )z P" "$ P| T+y! 6  t/" z ƈ"4 Ȋ"R ES ^ ~ h" * \}l " 4. - * @2B  4+ d- + @ ) Z t*g +l 0F2 q .w +~ - 8 H" , ̊" `3 X"pwlz:H"]pj/ it,%*n-",/*-p"T}@z -.XAKgoyLCYMLOEB1.sched_min.XAKgoyLCYMLOEB1.scan_intervalfcntlpthread_mutex_initinet_ntoa.XAKgoyLCYMLOEB1.unpending_mutexmem_freefprintfmy_getopt__1cG__CrunMdo_exit_code6F_v_mem_initgetuptime.XAKgoyLCYMLOkE1.element_size.XAKgoyLCYMLOUC1.NetFlow1_Flowfreopen_xmknod.XAKgoyLCYMLOEB1.thidselectfreeaddrinfostrlenput_into.XAKgoyLCYMLOEB1.pending_tail.XAKgoyLCYMLOEB1.verbositytotal_elements.XAKgoyLCYMLOEB1.flows.XAKgoyLCYMLOEB1.emit_counthashpcap_geterr.XAKgoyLCYMLOEB1.flows_emitmemset.XAKgoyLCYMLOEB1.npeerspcap_callback.XAKgoyLCYMLOEB1.npeers_rotsigemptysethtonl_GLOBAL_OFFSET_TABLE_pthread_mutex_lock_DYNAMICsetsid.XAKgoyLCYMLOEB1.log_destpcap_loop__environ_lock.XAKgoyLCYMLOEB1.start_time_offsethtons.XAKgoyLCYMLOEB1.sched_max.XAKgoyLCYMLOUJ1.my_log_namesmem_alloc.XAKgoyLCYMLOEB1.scan_cond__fsr__iob.XAKgoyLCYMLOUJ1.my_log_indentmy_logvsnprintf.XAKgoyLCYMLOEB1.pwpcap_open_livepthread_setconcurrencytotal_memorysprintfstrchr.XAKgoyLCYMLOkE1.mem_mutex_endkill.XAKgoyLCYMLOEB1.parms.XAKgoyLCYMLOUC1.NetFlow5_Flow.XAKgoyLCYMLOkE1.rootpthread_creategettime.XAKgoyLCYMLOEB1.pidNetFlow1.XAKgoyLCYMLOEB1.promiscNetFlow5.XAKgoyLCYMLOkE1.element_table_sizepcap_filenoNetFlow7_lxstathash_init_environmalloc.XAKgoyLCYMLOEB1.snmp_input_index.XAKgoyLCYMLOEB1.pending_head.XAKgoyLCYMLOUJ1.my_log_min_levelemit_thread.XAKgoyLCYMLOEB1.unpending_cond.XAKgoyLCYMLOEB1.emit_packetsetvbuf_fini.XAKgoyLCYMLOED1.crc16_polybind.XAKgoyLCYMLOEB1.off_nl.XAKgoyLCYMLOkE1.mem_index_table_size.XBKgoyLCYMLOEI1.my_getopt.my_opterr.XAKgoyLCYMLOUC1.NetFlow7_Flowgetpwnam__longdouble_used_lib_versionpthread_sigmaskcloselog.XAKgoyLCYMLOEB1.peersscan_thread.XAKgoyLCYMLOEB1.start_timesched_get_priority_maxcopy_flowpthread_cond_signalatexit.XAKgoyLCYMLOEB1.sockbufsizeremove.XAKgoyLCYMLOEB1.frag_lifetime.XAKgoyLCYMLOEB1.filterusage.XAKgoyLCYMLOEB1.sig_mask.XAKgoyLCYMLOEB1.scan_mutexopenlog__xtolpcap_compile.XAKgoyLCYMLOEB1.pidfilesetgroupssighandler___errno.XAKgoyLCYMLOEB1.netflowmy_log_close_exitpthread_attr_setschedpolicysetregidsyslogcrc16.XAKgoyLCYMLOEB1.killedpcap_lookupdev.XAKgoyLCYMLOEB1.active_lifetime.XAKgoyLCYMLOEB1.emit_mutex.XAKgoyLCYMLOkE1.bulk_quantity.XAKgoyLCYMLOEB1.pending_queue_lengthgetpid.XAKgoyLCYMLOEB1.emit_condpcap_datalink.XAKgoyLCYMLOEB1.dev.XAKgoyLCYMLOEB1.emit_sequence___Argvoptind.XBKgoyLCYMLOEB1.main.threads_startsrandgetaddrinfosigaddsetunpending_thread.XAKgoyLCYMLOEB1.emit_rate_bytessetreuid.XAKgoyLCYMLOEB1.flows_mutex.XAKgoyLCYMLOED1.shuffle_tablenanosleep.XAKgoyLCYMLOUJ1.my_log_flags_xstat_fxstat.XAKgoyLCYMLOUC1.NetFlow1_Header.XAKgoyLCYMLOUC1.NetFlow7_Header__fsr_init_value.XAKgoyLCYMLOEB1.off_tlfree_elementsconnectstrcat.XBKgoyLCYMLOEI1.my_getopt.optstringpcap_setfiltersocketpcap_open_offline.XAKgoyLCYMLOEB1.inactive_lifetimecmpmtimefclose__fpstart.XAKgoyLCYMLOEB1.emit_time.XAKgoyLCYMLOEB1.schedp.XAKgoyLCYMLOEB1.identsched_get_priority_minfill_get_exit_frame_monitor.XAKgoyLCYMLOEB1.bulk_quantity.XAKgoyLCYMLOED1.crc16_table.XAKgoyLCYMLOkE1.limit_memorypcap_thread.XBKgoyLCYMLOEI1.my_getopt.flag.XAKgoyLCYMLOEB1.link_layerpthread_cond_timedwaitdlt.XAKgoyLCYMLOEB1.pidfilepathfopenpthread_detachpthread_mutex_unlockhash_flowstrerrorsigactionntohs.XAKgoyLCYMLOUC1.NetFlow5_Header_PROCEDURE_LINKAGE_TABLE_gettimeofdayatoimainfreadsscanfpthread_attr_init.XAKgoyLCYMLOEB1.sigs.XAKgoyLCYMLOEB1.emit_rate_delay_edata.XAKgoyLCYMLOkE1.malloc_sizefind.XAKgoyLCYMLOEB1.scan_frag_dreg_etext.XAKgoyLCYMLOEB1.unpending_timeout.XAKgoyLCYMLOEB1.snmp_output_indexmy_log_openforkpthread_attr_setschedparamoptargsetsockoptcallocsendchdir.XAKgoyLCYMLOEB1.pcap_handle.XAKgoyLCYMLOEB1.link_layer_size.XAKgoyLCYMLOEB1.emit_timeoutchrootlibrt.so.1SUNW_1.1libnsl.so.1SUNW_0.7libsocket.so.1SUNW_1.4libc.so.1SUNW_1.18SUNWprivate_1.1libpcap.so.1/usr/local/lib:/lib:/usr/lib '= $ (= 09 '= HQy[qN ey "2"p""|ww~wlwwwKwwwww%ww#w,wwww{wkww)ww>wwiwww;w:wwwNwxxx` xx[xx'x x$xX(x,x0x4x78xIEP4EP4+E@}t뽐WN먋E@u*E}"E؋U;|E؋UMD Ad"P4d"P4d"@8d"jhpzCÐUjjjh0Bjp"P9j@P6Phpj$ jt"P&ÐUD@<DžDžDžjj0jj4jjP j jP DžDžDž"hzE PEPe tG'"?ththzE PEP u{H{{أx"T{|"|"t|"@-u H|{tj{P Dž{tj{Pz0{tj4{Pz{tj{Pyz{tj{PZz{txN$zgbȀ$zSh$qhqh" jjp+j{P}t뼃tt밡 |tj$|PL|{j:{PtYB@@t/Ph4qP` PhP|\{@tj{PH|tH:BjhP|jP``"`u2j@PGPhPBBBB jP`{tjd{PT}p{h"|j|PV``X}`uf@tj@P:\q\jj\P|Phqh"0jjE+"<"<"}<"jPU``@"`u:"<";EE j:Pu4B@jjj }2j@PPhqh" jj<"Ћ@"ЋB<"Ћ@"B$<"Ћ@"ЋBBBB <"Ћ@"B(j/P_PB@j/PB@Ab<"Ћ@"B$L"@L"-L@m} t␐mtrtԋ@t~jjPPjPt<"Ћ5@"SBFBFBFB F jPj<"Ћ@"jBPPf t2j@PNPhqh"k jjjjPPPPt%<"@Phqh" jj<"Ћ5@"SBFBFBF B FjP\<"Ћ@"jBPPh t2 j@P@Phrh"] jjtH/BtH/BH:B@<"\<"@<"\`;E H|PL|PhP| H|j@P8Ph(rh"U jj1h"h@rh4r- h"hDrh4r h"hDrh4r *jjbtې0jjjjjh"jjjjjh"t"t"PhHrP PhP||"uOjP``|"`u"PhPrjh jj|"@-uKP|"P=p"p"u"Phhrj jjLjPhx"PP|"Pp"p"u"Phrj jj"tTjp"Pjjh"hhP}#j@PPhrjK jp"PDž\};t\}u'd}`"@뙐T}| T}`"`"u"Phrj jj${${jjjPPp"Pu8jp"PjjPRhrjjjQPp"Plu,jp"PGPhrj jj hsj P zPj< Dž=}7jDP@=|8"jh<! ``d"`uqd"T"P}H`H`\\9 XT"XP8Xu/j@PPh jjvjjjPPh">t/Aj@PvPhsj jjj"P "@"@X}jj}/j@PPhsj] jjX}X}@ PB Pt=X}gj@PjjPC Phsjjj8X}X}@PBPMt=X} j@P?jjPCPhsjjjhDr"P``"`u%j@PPhtjE )t"Ph,t"P j"Pt"Ph4tj jPl}P|"PhEPRUfUƈ"UEƇ"E@EE=|EE=}k(EE kkk]EEEƇ"EEUƇ"Ƈ"UEƇ"E@EE=|]UjhBĞ")Ȋ"t+"̊";Ȋ"vEx@ Kj̊"PoEEu+EEEЊ"EEE;Ԋ"s0EUPEEE؊"EE@EE;Ԋ"rСԊ"UHBEĞ"PĞ""Ԋ"""̊""EUPE܊"+؊"EP E"PE"E@ EW"EE@uE@EE@tE@UHBĞ"HĞ"EEEPEEjhEEEÐU jh"E"EE@;Ew E@ ;Es%EEE@EE@;EwE@ ;ErۋEEEPEM E@U@BĞ"@Ğ"E@;Ԋ"uJEU@BjEPn"+Ԋ""Ğ"+Ԋ"Ğ""+̊""jhÐUE Ԋ"Ԋ"Њ"E؊"؊"Ԋ"܊"Њ"܊"̊"EȊ"EEUE@EEEEEEEEUE=}xEUM"E@EEUDtU:"E@EU"E@EEUt E=|h"E PEP Ethvh"EEUtjEUDt Network interface name -f Filter expression (see tcpdump manual for details) -s How often scan for expired flows [5] -g Fragmented flow lifetime [30] -d Idle flow lifetime (inactive timer) [60] -e Active flow lifetime (active timer) [300] -n NetFlow version for use (1, 5 or 7) [5] -a
Use
as source for NetFlow flow -x [:] Workaround for SNMP interfaces indexes [0] -b Memory bulk size (1..%u) [%u] -m Memory limit (0=no limit) [0] -q Pending queue length [100] -B Kernel capture buffer size [0] -r Real-time priority (0=disabled, %d..%d) [0] -t Produce nanosecond delay after each bytes sent [0:0] -S Snaplen [256] -K Link layer header size -k Don't exclude link layer header from packet size -c Directory to chroot to -u User to run as -v Maximum log level (0=EMERG, ..., 6=INFO, 7=DEBUG) [6] -l <[dst][:id]> Log destination and log/pidfile idetifier [1] remote:port Address of the NetFlow collector 1.1fill(): Unknown format at %x[%d]: %dpcap_loop() terminated: %sIllegal %s NetFlow version[%s]malloc(): %s %s/%s.pid/var/runpending queue lengthrealtime prioritybulk size%d:%dsource addressgetpwnam(%s): %s Unknown usersocket(): %s bind(): %s Error in collector #%d parameters connect(): %s fork(): %s/dev/nullrw[%ld]pcap_lookupdev(): %s pcap_open_offline(): %spcap_open_live(): %ssetsockopt(): %sUknown data link type %d. Use -K option.pcap_compile(): %s. Filter: %spcap_setfilter(): %sFilter expression is empty! Are you sure?mem_alloc(): %spthread_sigmask(): %sStarting %s....could not chroot to %s: %spthread_attr_setschedpolicy(): %spthread_create(): %ssetgroups: %ssetregid(%u): %ssetreuid(%u): %sCan't create pid file. fopen(): %s%ld pid: %dinterface: %s, datalink: %s (%d)filter: "%s"options: p=%d s=%u g=%u d=%u e=%u n=%u a=%s x=%u:%u b=%u m=%u q=%u B=%u r=%u t=%u:%u S=%d K=%d k=%d c=%s u=%s v=%u l=%u%s%scollector #%d: %s:%u/%s/%cSIGTERM received. Emitting flows cache...Done.NULLEN10MBIEEE802ARCNETSLIPPPPFDDIATM_RFC1483RAWSLIP_BSDOSPPP_BSDOSATM_CLIPPPP_SERIALPPP_ETHERC_HDLCIEEE802_11LOOPLINUX_SLLLTALKPRISM_HEADERIP_OVER_FCSUNATMARCNET_LINUXENCFRELAYIEEE802_11_RADIOPFLOGLINUX_IRDAAPPLE_IP_OVER_IEEE1394IEEE802_11_RADIO_AVSUNKNOWN/dev/randomrWrong parameters Missing required option Option `-%c': %s require parameterrepeat not allowed[%s]: %s%s%s%s EMERGALERTCRITERRWARNINGNOTICEINFODEBUGx)) ****:*J*Z*j*z********* ++*+:+J+Z+j+z+++++++++ ,,*,:,J,Z,j,z,,,,,,,,, --*-:-J-Z-j-z--------- ..*.:.J.Z.j.z......... //*/:/J/Z/j/z/u$9Q xk k L ooL&o'&o`opwt/'XMVCXMVCXMVC<,aBbcdefghiKklmnpqrSstuvxfprobedLu Tu\udulu tu xu u uuuu2u3uhui uluquruwuz v{ v vm 0vk4vX`[T.HTzie rd*}$/ f_  2 ؊"&d,T*"t.,$++P4 4T"RL|m"|DL"b -4"t+<"0B L"%D-1*7pwM*`xiT,pH|$+y8"*4  0d z* 0{ 0"6"Uj ]d.fX}z,-"++Ȟ"D+z("--?.Dt"Y$bx"{$܊",Ȁ$4*b y+D"xk d""zPg A; MpzmX"m/,k ć"4,`"Њ"T*;,.DyVkct-sD/|@"@. <d+2 +*".z":R01< X"rz4/.-".p1" *$zj   ) -) .2 d/9 pa ? \"W ,f z (z Ԋ" P} , Dz , |"- P"L yT "[ y / . + T- P? D" $. D Ƈ" * "; $*B D*J   .\T/k F  l"<1( Ğ" D, + " $- $, , zB 1M K D.1"!R )\ P"w "$ P| T+y! 6  t/" z ƈ" Ȋ"4 ES @ ` h"| * \}l " 4. - * @2B 4+ d- + ") <t*I+N0F2 S.Y+`-r8H",̊"`3 X"pwlzH"?pj/ Kt, *P-k"r,}/*-p"T}@z-fprobecrti.scrt1.ocrt1.s__get_exit_frame_monitor_ptr__do_exit_code_ptrfsr.strap_tablevalues-Xa.cDdata.dataBbss.bssDrodata.rodatafprobe.cfstatlstat_xmknodnetflow.chash.cmem.cmy_getopt.cmy_log.ccrtn.s_END__START_.XAKgoyLCYMLOEB1.sched_min.XAKgoyLCYMLOEB1.scan_intervalfcntlpthread_mutex_initinet_ntoa.XAKgoyLCYMLOEB1.unpending_mutexmem_freefprintfmy_getopt__1cG__CrunMdo_exit_code6F_v_mem_initgetuptime.XAKgoyLCYMLOkE1.element_size.XAKgoyLCYMLOUC1.NetFlow1_Flowfreopen.XAKgoyLCYMLOEB1.thidselectfreeaddrinfostrlenput_into.XAKgoyLCYMLOEB1.pending_tail.XAKgoyLCYMLOEB1.verbositytotal_elements.XAKgoyLCYMLOEB1.flows.XAKgoyLCYMLOEB1.emit_counthashpcap_geterr.XAKgoyLCYMLOEB1.flows_emitmemset.XAKgoyLCYMLOEB1.npeerspcap_callback.XAKgoyLCYMLOEB1.npeers_rotsigemptysethtonl_GLOBAL_OFFSET_TABLE_pthread_mutex_lock_DYNAMICsetsid.XAKgoyLCYMLOEB1.log_destpcap_loop__environ_lock.XAKgoyLCYMLOEB1.start_time_offsethtons.XAKgoyLCYMLOEB1.sched_max.XAKgoyLCYMLOUJ1.my_log_namesmem_alloc.XAKgoyLCYMLOEB1.scan_cond__fsr__iob.XAKgoyLCYMLOUJ1.my_log_indentmy_logvsnprintf.XAKgoyLCYMLOEB1.pwpcap_open_livepthread_setconcurrencytotal_memorysprintfstrchr.XAKgoyLCYMLOkE1.mem_mutex_endkill.XAKgoyLCYMLOEB1.parms.XAKgoyLCYMLOUC1.NetFlow5_Flow.XAKgoyLCYMLOkE1.rootpthread_creategettime.XAKgoyLCYMLOEB1.pidNetFlow1.XAKgoyLCYMLOEB1.promiscNetFlow5.XAKgoyLCYMLOkE1.element_table_sizepcap_filenoNetFlow7_lxstathash_init_environmalloc.XAKgoyLCYMLOEB1.snmp_input_index.XAKgoyLCYMLOEB1.pending_head.XAKgoyLCYMLOUJ1.my_log_min_levelemit_thread.XAKgoyLCYMLOEB1.unpending_cond.XAKgoyLCYMLOEB1.emit_packetsetvbuf_fini.XAKgoyLCYMLOED1.crc16_polybind.XAKgoyLCYMLOEB1.off_nl.XAKgoyLCYMLOkE1.mem_index_table_size.XBKgoyLCYMLOEI1.my_getopt.my_opterr.XAKgoyLCYMLOUC1.NetFlow7_Flowgetpwnam__longdouble_used_lib_versionpthread_sigmaskcloselog.XAKgoyLCYMLOEB1.peersscan_thread.XAKgoyLCYMLOEB1.start_timesched_get_priority_maxcopy_flowpthread_cond_signalatexit.XAKgoyLCYMLOEB1.sockbufsizeremove.XAKgoyLCYMLOEB1.frag_lifetime.XAKgoyLCYMLOEB1.filterusage.XAKgoyLCYMLOEB1.sig_mask.XAKgoyLCYMLOEB1.scan_mutexopenlog__xtolpcap_compile.XAKgoyLCYMLOEB1.pidfilesetgroupssighandler___errno.XAKgoyLCYMLOEB1.netflowmy_log_close_exitpthread_attr_setschedpolicysetregidsyslogcrc16.XAKgoyLCYMLOEB1.killedpcap_lookupdev.XAKgoyLCYMLOEB1.active_lifetime.XAKgoyLCYMLOEB1.emit_mutex.XAKgoyLCYMLOkE1.bulk_quantity.XAKgoyLCYMLOEB1.pending_queue_lengthgetpid.XAKgoyLCYMLOEB1.emit_condpcap_datalink.XAKgoyLCYMLOEB1.dev.XAKgoyLCYMLOEB1.emit_sequence___Argvoptind.XBKgoyLCYMLOEB1.main.threads_startsrandgetaddrinfosigaddsetunpending_thread.XAKgoyLCYMLOEB1.emit_rate_bytessetreuid.XAKgoyLCYMLOEB1.flows_mutex.XAKgoyLCYMLOED1.shuffle_tablenanosleep.XAKgoyLCYMLOUJ1.my_log_flags_xstat_fxstat.XAKgoyLCYMLOUC1.NetFlow1_Header.XAKgoyLCYMLOUC1.NetFlow7_Header__fsr_init_value.XAKgoyLCYMLOEB1.off_tlfree_elementsconnectstrcat.XBKgoyLCYMLOEI1.my_getopt.optstringpcap_setfiltersocketpcap_open_offline.XAKgoyLCYMLOEB1.inactive_lifetimecmpmtimefclose__fpstart.XAKgoyLCYMLOEB1.emit_time.XAKgoyLCYMLOEB1.schedp.XAKgoyLCYMLOEB1.identsched_get_priority_minfill_get_exit_frame_monitor.XAKgoyLCYMLOEB1.bulk_quantity.XAKgoyLCYMLOED1.crc16_table.XAKgoyLCYMLOkE1.limit_memorypcap_thread.XBKgoyLCYMLOEI1.my_getopt.flag.XAKgoyLCYMLOEB1.link_layerpthread_cond_timedwaitdlt.XAKgoyLCYMLOEB1.pidfilepathfopenpthread_detachpthread_mutex_unlockhash_flowstrerrorsigactionntohs.XAKgoyLCYMLOUC1.NetFlow5_Header_PROCEDURE_LINKAGE_TABLE_gettimeofdayatoimainfreadsscanfpthread_attr_init.XAKgoyLCYMLOEB1.sigs.XAKgoyLCYMLOEB1.emit_rate_delay_edata.XAKgoyLCYMLOkE1.malloc_sizefind.XAKgoyLCYMLOEB1.scan_frag_dreg_etext.XAKgoyLCYMLOEB1.unpending_timeout.XAKgoyLCYMLOEB1.snmp_output_indexmy_log_openforkpthread_attr_setschedparamoptargsetsockoptcallocsendchdir.XAKgoyLCYMLOEB1.pcap_handle.XAKgoyLCYMLOEB1.link_layer_size.XAKgoyLCYMLOEB1.emit_timeoutchrootanotate anotate0 ,(/x/k)0yyanotate@ <8R:;:D;:\;:h;;7;p7;: ;`8;|8;8;(8;7 ;9$;87(;D8,;70;94;T78;9<;9@;9D;8H;8L;9P;89T;`9X;9\;9`;9d;9h;9l;9p;9E0BXp1;@P?Eanotate anotate @(#)stdio.h 1.84 04/09/28 SMI@(#)feature_tests.h 1.25 07/02/02 SMI@(#)ccompile.h 1.2 04/11/08 SMI@(#)isa_defs.h 1.29 08/06/06 SMI@(#)stdio_iso.h 1.8 05/08/16 SMI@(#)va_list.h 1.15 04/11/19 SMI@(#)stdio_tag.h 1.4 04/09/28 SMI@(#)stdio_impl.h 1.15 07/03/05 SMI@(#)stdio_c99.h 1.2 04/03/29 SMI@(#)stdlib.h 1.51 04/06/30 SMI@(#)stdlib_iso.h 1.9 04/09/28 SMI@(#)stdlib_c99.h 1.2 04/03/29 SMI@(#)unistd.h 1.76 06/03/10 SMI@(#)types.h 1.86 07/09/20 SMI@(#)machtypes.h 1.11 04/09/28 SMI@(#)machtypes.h 1.2 04/09/28 SMI@(#)int_types.h 1.10 04/09/28 SMI@(#)select.h 1.19 04/01/28 SMI@(#)time_impl.h 1.11 05/05/19 SMI@(#)time.h 2.77 09/06/02 SMI@(#)time.h 1.45 08/01/09 SMI@(#)time_iso.h 1.4 04/09/07 SMI@(#)unistd.h 1.43 06/03/10 SMI@(#)string.h 1.27 07/01/14 SMI@(#)string_iso.h 1.5 04/06/18 SMI@(#)signal.h 1.43 04/09/28 SMI@(#)signal_iso.h 1.1 99/08/09 SMI@(#)signal_iso.h 1.6 03/05/02 SMI@(#)signal.h 1.66 04/09/28 SMI@(#)siginfo.h 1.59 04/07/15 SMI@(#)machsig.h 1.11 03/09/26 SMI@(#)faultcode.h 1.16 09/07/02 SMI@(#)procset.h 1.25 04/07/16 SMI@(#)in_systm.h 1.7 01/09/25 SMI@(#)socket.h 1.78 08/01/18 SMI@(#)uio.h 1.34 09/06/15 SMI@(#)socket_impl.h 1.1 05/08/02 SMI@(#)un.h 1.11 02/10/02 SMI@(#)if_dl.h 1.10 03/05/21 SMI@(#)netconfig.h 1.24 04/02/27 SMI@(#)in.h 1.55 09/05/27 SMI@(#)stream.h 1.115 08/07/22 SMI@(#)vnode.h 1.133 09/07/17 SMI@(#)t_lock.h 1.45 98/02/01 SMI@(#)machlock.h 1.25 04/07/19 SMI@(#)param.h 1.82 06/01/30 SMI@(#)mutex.h 1.21 07/04/04 SMI@(#)rwlock.h 1.9 98/02/18 SMI@(#)semaphore.h 1.5 98/02/01 SMI@(#)condvar.h 1.14 04/10/21 SMI@(#)rwstlock.h 1.4 04/11/09 SMI@(#)ksynch.h 1.6 97/10/22 SMI@(#)cred.h 1.27 06/05/03 SMI@(#)resource.h 1.37 07/02/07 SMI@(#)seg_enum.h 1.9 09/07/02 SMI@(#)kstat.h 1.22 07/02/02 SMI@(#)kmem.h 1.38 09/05/07 SMI@(#)vmem.h 1.12 05/06/27 SMI@(#)poll.h 1.28 98/11/23 SMI@(#)strmdep.h 1.10 98/01/06 SMI@(#)model.h 1.24 04/09/28 SMI@(#)strft.h 1.2 00/03/17 SMI@(#)byteorder.h 1.18 04/09/28 SMI@(#)inet.h 1.21 08/01/04 SMI@(#)ip.h 1.14 05/08/02 SMI@(#)tcp.h 1.18 05/12/21 SMI@(#)inttypes.h 1.3 03/12/04 SMI@(#)int_limits.h 1.9 04/09/28 SMI@(#)int_const.h 1.5 04/09/28 SMI@(#)int_fmtio.h 1.6 04/09/28 SMI@(#)udp.h 1.8 08/11/19 SMI@(#)ip_icmp.h 1.7 02/01/14 SMI@(#)pwd.h 1.22 04/09/28 SMI@(#)pthread.h 1.37 04/09/28 SMI@(#)sched.h 1.10 03/03/06 SMI@(#)errno.h 1.17 03/01/03 SMI@(#)errno.h 1.20 00/01/12 SMI@(#)netdb.h 1.30 03/12/04 SMI@(#)stat.h 1.11 04/09/28 SMI@(#)stat_impl.h 1.4 03/12/04 SMI@(#)fcntl.h 1.17 06/03/10 SMI@(#)fcntl.h 1.52 07/03/05 SMI@(#)inttypes.h 1.4 04/04/29 SMI@(#)stdint.h 1.1 03/12/04 SMI@(#)syslog.h 1.11 96/05/17 SMI@(#)syslog.h 1.11 03/06/10 SMIacomp: Sun C 5.11 SunOS_i386 145355-01 2010/10/11as: Sun Compiler Common 12.2 SunOS_i386 2010/08/13@(#)inttypes.h 1.4 04/04/29 SMI@(#)feature_tests.h 1.25 07/02/02 SMI@(#)ccompile.h 1.2 04/11/08 SMI@(#)isa_defs.h 1.29 08/06/06 SMI@(#)inttypes.h 1.3 03/12/04 SMI@(#)int_types.h 1.10 04/09/28 SMI@(#)int_limits.h 1.9 04/09/28 SMI@(#)int_const.h 1.5 04/09/28 SMI@(#)int_fmtio.h 1.6 04/09/28 SMI@(#)stdint.h 1.1 03/12/04 SMIacomp: Sun C 5.11 SunOS_i386 145355-01 2010/10/11as: Sun Compiler Common 12.2 SunOS_i386 2010/08/13@(#)stdio.h 1.84 04/09/28 SMI@(#)feature_tests.h 1.25 07/02/02 SMI@(#)ccompile.h 1.2 04/11/08 SMI@(#)isa_defs.h 1.29 08/06/06 SMI@(#)stdio_iso.h 1.8 05/08/16 SMI@(#)va_list.h 1.15 04/11/19 SMI@(#)stdio_tag.h 1.4 04/09/28 SMI@(#)stdio_impl.h 1.15 07/03/05 SMI@(#)stdio_c99.h 1.2 04/03/29 SMI@(#)stdlib.h 1.51 04/06/30 SMI@(#)stdlib_iso.h 1.9 04/09/28 SMI@(#)stdlib_c99.h 1.2 04/03/29 SMI@(#)unistd.h 1.76 06/03/10 SMI@(#)types.h 1.86 07/09/20 SMI@(#)machtypes.h 1.11 04/09/28 SMI@(#)machtypes.h 1.2 04/09/28 SMI@(#)int_types.h 1.10 04/09/28 SMI@(#)select.h 1.19 04/01/28 SMI@(#)time_impl.h 1.11 05/05/19 SMI@(#)time.h 2.77 09/06/02 SMI@(#)time.h 1.45 08/01/09 SMI@(#)time_iso.h 1.4 04/09/07 SMI@(#)unistd.h 1.43 06/03/10 SMI@(#)fcntl.h 1.17 06/03/10 SMI@(#)fcntl.h 1.52 07/03/05 SMI@(#)inttypes.h 1.4 04/04/29 SMI@(#)inttypes.h 1.3 03/12/04 SMI@(#)int_limits.h 1.9 04/09/28 SMI@(#)int_const.h 1.5 04/09/28 SMI@(#)int_fmtio.h 1.6 04/09/28 SMI@(#)stdint.h 1.1 03/12/04 SMIacomp: Sun C 5.11 SunOS_i386 145355-01 2010/10/11as: Sun Compiler Common 12.2 SunOS_i386 2010/08/13@(#)stdlib.h 1.51 04/06/30 SMI@(#)stdlib_iso.h 1.9 04/09/28 SMI@(#)feature_tests.h 1.25 07/02/02 SMI@(#)ccompile.h 1.2 04/11/08 SMI@(#)isa_defs.h 1.29 08/06/06 SMI@(#)stdlib_c99.h 1.2 04/03/29 SMI@(#)string.h 1.27 07/01/14 SMI@(#)string_iso.h 1.5 04/06/18 SMI@(#)syslog.h 1.11 96/05/17 SMI@(#)syslog.h 1.11 03/06/10 SMI@(#)va_list.h 1.15 04/11/19 SMI@(#)errno.h 1.17 03/01/03 SMI@(#)errno.h 1.20 00/01/12 SMI@(#)inttypes.h 1.4 04/04/29 SMI@(#)inttypes.h 1.3 03/12/04 SMI@(#)int_types.h 1.10 04/09/28 SMI@(#)int_limits.h 1.9 04/09/28 SMI@(#)int_const.h 1.5 04/09/28 SMI@(#)int_fmtio.h 1.6 04/09/28 SMI@(#)stdint.h 1.1 03/12/04 SMI@(#)pthread.h 1.37 04/09/28 SMI@(#)types.h 1.86 07/09/20 SMI@(#)machtypes.h 1.11 04/09/28 SMI@(#)machtypes.h 1.2 04/09/28 SMI@(#)select.h 1.19 04/01/28 SMI@(#)time_impl.h 1.11 05/05/19 SMI@(#)time.h 2.77 09/06/02 SMI@(#)time.h 1.45 08/01/09 SMI@(#)time_iso.h 1.4 04/09/07 SMI@(#)sched.h 1.10 03/03/06 SMIacomp: Sun C 5.11 SunOS_i386 145355-01 2010/10/11as: Sun Compiler Common 12.2 SunOS_i386 2010/08/13@(#)unistd.h 1.76 06/03/10 SMI@(#)feature_tests.h 1.25 07/02/02 SMI@(#)ccompile.h 1.2 04/11/08 SMI@(#)isa_defs.h 1.29 08/06/06 SMI@(#)types.h 1.86 07/09/20 SMI@(#)machtypes.h 1.11 04/09/28 SMI@(#)machtypes.h 1.2 04/09/28 SMI@(#)int_types.h 1.10 04/09/28 SMI@(#)select.h 1.19 04/01/28 SMI@(#)time_impl.h 1.11 05/05/19 SMI@(#)time.h 2.77 09/06/02 SMI@(#)time.h 1.45 08/01/09 SMI@(#)time_iso.h 1.4 04/09/07 SMI@(#)unistd.h 1.43 06/03/10 SMI@(#)stdio.h 1.84 04/09/28 SMI@(#)stdio_iso.h 1.8 05/08/16 SMI@(#)va_list.h 1.15 04/11/19 SMI@(#)stdio_tag.h 1.4 04/09/28 SMI@(#)stdio_impl.h 1.15 07/03/05 SMI@(#)stdio_c99.h 1.2 04/03/29 SMIacomp: Sun C 5.11 SunOS_i386 145355-01 2010/10/11as: Sun Compiler Common 12.2 SunOS_i386 2010/08/13@(#)syslog.h 1.11 96/05/17 SMI@(#)feature_tests.h 1.25 07/02/02 SMI@(#)ccompile.h 1.2 04/11/08 SMI@(#)isa_defs.h 1.29 08/06/06 SMI@(#)syslog.h 1.11 03/06/10 SMI@(#)va_list.h 1.15 04/11/19 SMI@(#)stdarg.h 1.47 04/09/28 SMI@(#)stdarg_iso.h 1.4 04/11/19 SMI@(#)va_impl.h 1.1 04/11/19 SMI@(#)stdarg_c99.h 1.2 04/09/28 SMI@(#)stdio.h 1.84 04/09/28 SMI@(#)stdio_iso.h 1.8 05/08/16 SMI@(#)stdio_tag.h 1.4 04/09/28 SMI@(#)stdio_impl.h 1.15 07/03/05 SMI@(#)stdio_c99.h 1.2 04/03/29 SMI@(#)stdlib.h 1.51 04/06/30 SMI@(#)stdlib_iso.h 1.9 04/09/28 SMI@(#)stdlib_c99.h 1.2 04/03/29 SMIacomp: Sun C 5.11 SunOS_i386 145355-01 2010/10/11as: Sun Compiler Common 12.2 SunOS_i386 2010/08/13ld: Software Generation Utilities - Solaris Link Editors: 5.10-1.4971fprobe.c /var/tmp/fprobe-1.1/src /opt/solstudio12.2/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c fprobe.c -W0,-xp.XAKgoyLCYMLOEB1.Xa;g;R=Sun C 5.11 SunOS_i386 145355-01 2010/10/11;G=.XAKgoyLCYMLOEB1.;backend;raw;cd;DBG_GEN 5.3.0statx00Urr_pathr_bufr intcharyunsigned longdev_tlong  ino_tmode_tnlink_tuid_tgid_t off_ttime_t timespecZ tv_sec# tv_nsec#*timestruc_tblksize_tblkcnt_ty    stat st_dev# st_pad1# st_ino# st_mode# st_nlink# st_uid# st_gid# st_rdev#$ st_pad2#( st_size#0 st_pad3#4 st_atimZ#8 st_mtimZ#@ st_ctimZ#H st_blksizel#P st_blocks|#T st_fstype#X st_pad4#hlstat00Ur!&_path_buf y!fstat01Urgr_fd_buf mknod1(1Ur_path_mode _devyunsignedy DLT: linktyper# offset_link# offset_nl# offset_nl_nosnap# descr# lL  dlt:O\} getopt_parms  namey# flagr# countr# arg# _parmsz _ parmszfilterscan_intervalzfrag_lifetimerzinactive_lifetimerzactive_lifetimerzbulk_quantity zpending_queue_lengthP}unsigned shortuint16_t  NetFlow$  Version# HeaderSize# MaxFlows# FlowSize# SeqOffset# HeaderFields# HeaderFormat# FlowFields# FlowFormat# netflow$zverbosityL|log_destH|link_layer_sizerT}unsigned charuint8_t  __pthread_mutex_flag1# __pthread_mutex_flag2# __pthread_mutex_ceiling# __pthread_mutex_type# __pthread_mutex_magic#  __pthread_mutex_pad#uint32_t F __pthread_ownerpid# __pthread_lockword#unsigned long longF upad64_t __pthread_mutex_lock64# __pthread_mutex_lock32 # __pthread_mutex_owner64\ # _pthread_mutex@ __pthread_mutex_flags%# __pthread_mutex_lockk # __pthread_mutex_data\ # pthread_mutex_tunpending_mutex@ ,Tz  __pthread_cond_flagu # __pthread_cond_type# __pthread_cond_magic# _pthread_cond2 __pthread_cond_flags # __pthread_cond_data\ # pthread_cond_tunpending_cond2 -pzscan_mutex@ /zscan_cond2 0zemit_mutex@ 4(zemit_cond2 5Dz y ident 8P|emit_timeoutr=@zunpending_timeoutr=lz passwd$ pw_name# pw_passwd# pw_uid# pw_gid# pw_age# pw_comment# pw_gecos# pw_dir# pw_shell# 0 pw ?X}usageB01l1Usighandlervp11U1 rsigugettime11Uq  nowt  Time sec# usec#q suseconds_t timeval tv_sec# tv_usec #cmpmtime12U t1 t2 getuptime 2?2UO thash_flow@22UAflowhash_t s_b1# s_b2# s_b3# s_b4# s_w1# s_w2#$ S_un_b# S_un_w# S_addr# in_addrA S_un#F Flow<% sip$# dip$# proto# id# sp# dp# tos# tcp_flags# pkts# size# sizeF# sizeP# ctimeq #$ mtimeq #, flagsr#4 nextA#8copy_flow2^3UmAsrcAdst Cfind`3O4UAAwhereAwhat prevflowppAput_intoP46Ur}Aflowrflag retrhflownAflowppCfill=6;Urfields<format< Aflow<p<ir>voidemit_thread;J?UflowApnow timeout*irretrsentrsizerdelayrpeer_rot_currpeer_rot_workrunpending_thread9P??Unnow :timeout*;scan_threadh@.BUirlflowAmflowppmnowq ntimeout*opcap_callback0BEUuseless.pkthdr 8packetnl tlflowAoff_fragrpsizerCu_charbpf_u_int32 pcap_pkthdr) ts # caplen# len# )3uchar_tushort_t ip ip_hl=#ip_v=# ip_tos=# ip_lenK# ip_idK# ip_offK# ip_ttl=# ip_p=# ip_sumK# ip_src$# ip_dst$#Zpcap_threadE#FUmain0FbaUrsrargcsargv errbufxbpf_filterdhostdportlhosttypelog_suffixcrirsockrmemory_limitrlink_typerlink_type_idxrsnaplenrhintsres+saddrQtattrsigacttthreadstimeout BC yu_intu_short bpf_insn code# jt# jf# k# bpf_program bf_len# bf_insns#socklen_tsa_family_tyO  sockaddr sa_family,# sa_data>#O addrinfo + ai_flagsr# ai_familyr# ai_socktyper# ai_protocolr# ai_addrlen# ai_canonname# ai_addr# ai_next+#in_port_tyQ  sockaddr_in sin_family,# sin_port0# sin_addr$# sin_zero@# _pthread_attr __pthread_attrp#pthread_attr_t) _handler# _sigaction#: T __sigbits)#:sigset_trt  sigaction  sa_flagsr# _funcptr# sa_maskT# sa_resvc# killedr<\"pid_tpid;t"pidfilepath:" __FILE  _cntr# _ptr)# _base)# _flag# _file# __orientation# __ionolock#  __seekable#  __extendedfd#  __xf_nocheck#  __filler#  .FILE pidfile9"flows_emitA64"scan_frag_dregA2X"pending_tailA1T"pending_headA1d" @ !flows_mutex*D A!flows)Dsigsr'8 peer,a sockr# addrQ# laddrQ# typer#$ seq#(peersa&@"npeers_rotr%L"npeersr%<"sched_maxr$4sched_minr$0r  sched_param$T sched_priorityr# sched_nicelimr# sched_nicer# sched_pad# schedp#"sig_maskT""pthread_tthid!""pcappcap_tpcap_handle p" emit_packetX"emit_timeq P"emit_rate_delayH"emit_rate_bytesD"emit_sequenceP"emit_countL"off_tlr l"off_nlr `"start_time_offset 8"start_timeq  <link_layerrh"snmp_output_indexH"snmp_input_indexD"sockbufsizer"dev|"promiscx"#mem_initr!$$$%mem_free!$&mem_alloc'hash_init#hash"$!$r"_#my_getoptrP"$r$"$$"yP"%my_logv"$$U"(%my_log_open"$$$ry"#_xmknodr"$"$"$$ry"#_lxstatr#$"$"$ry ##_xstatr;#$#$#$r#_fxstatre#$;#$r$%freeaddrinfo#$+y#y##+#getaddrinfor#$#$#$#$#r&___errno##pthread_setconcurrencyr$$r  *$#pthread_cond_timedwaitrZ$$$$$$!$#pthread_cond_signalr$$$#pthread_mutex_unlockr$$$#pthread_mutex_lockr$$$ _pthread_mutexattr% __pthread_mutexattrp#$%#pthread_mutex_initr<%$$$ %#pthread_detachr^%$c%)m%#pthread_creater%$^%$h%$t%$%#pthread_attr_setschedparamr%$%$%#pthread_attr_setschedpolicyr &$%$r#pthread_attr_initrE&$%#sched_get_priority_minro&$r#sched_get_priority_maxr&$ry& #__posix_getpwnam_rr&$&$ $$r$&#__posix_getpwuid_rr'$$ $$r$&y'#getpwnam B'$!'#inet_ntoa_'$$#socketr'$r$r$r'#setsockoptr'$r$r$r$'$rssize_t'#send''$'$'$$'O'#connectr-($r$($O-(#bindrY($r$2($#ntohsr($#htons($#htonl($#pcap_filenor($(#pcap_datalinkr($(y(#pcap_compiler,)$($($($r$#pcap_geterrK)$(#pcap_setfilterrr)$($(r)|)*)$$w)$))#pcap_loopr)$($r$)$)y)y#pcap_open_offline*$)$)y*#pcap_open_liveG*$ *$r$r$r$)#pcap_lookupdevi*$:i*#__posix_sigwaitr*$n*$#:*:#pthread_sigmaskr*$r$*$*#sigemptysetr*$*#sigaddsetr+$*$rt+t#sigactionrN+$r$+$"+#killrk+$$ryk+#strchr+$p+$ry+size_t#strlen++$+#strerror+$ry+#strcat ,$$+#memset.,$$r$#__posix_ttyname_rr],$r$$#__posix_getlogin_rr,$$r+setsid#setreuidr,$$#setregidr,$$,#setgroupsr-$r$,+getpid+forky$-#chrootrH-$)-yH-#chdirrk-$M-|-  fd_set- fds_bitsk-#|- #selectr-$r$-$-$-$--#__posix_ctime_r.$-$ tm$. tm_secr# tm_minr# tm_hourr# tm_mdayr# tm_monr# tm_yearr# tm_wdayr# tm_ydayr# tm_isdstr# ..#__posix_asctime_r.$.$*.*#nanosleepr/$.$.#gettimeofdayr)/$-$#mallocC/$%exitW/$ryW/#atoiry/$\/yy/#snprintfr/$$$~/(y/y/#sscanfr/$/$/(y/#sprintfr 0$$/(.y0#fprintfr90$ 0$0(#setvbufrc0$ 0$$r$yc0ym0#freopen0$h0$r0$y0y0#fopen0$0$0#fcloser0$ 0y0,remover$0?netflow.c /var/tmp/fprobe-1.1/src /opt/solstudio12.2/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c netflow.c -W0,-xp.XAKgoyLCYMLOUC1.Xa;g;R=Sun C 5.11 SunOS_i386 145355-01 2010/10/11;G=.XAKgoyLCYMLOUC1.;backend;raw;cd;DBG_GEN 5.3.00unsigned short7uint16_tlongIoXNetFlow1_Header`I XNetFlow1_HeaderNetFlow1_Flow`I&XNetFlow1_FlowNetFlow5_Header`* I4XNetFlow5_Header#* NetFlow5_Flow`6I(XNetFlow5_Flown6NetFlow7_Header`MFIXNetFlow7_HeaderMFNetFlow7_Flow`WTI*XNetFlow7_FlowWTunsigned I NetFlow$ Version1# HeaderSize1# MaxFlows1# FlowSize1# SeqOffset1# HeaderFields1# HeaderFormat=# FlowFields1# FlowFormat=# NetFlow1Bo NetFlow5B{ NetFlow7BȀ#hash.c /var/tmp/fprobe-1.1/src /opt/solstudio12.2/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c hash.c -W0,-xp.XAKgoyLCYMLOED1.Xa;g;R=Sun C 5.11 SunOS_i386 145355-01 2010/10/11;G=.XAKgoyLCYMLOED1.;backend;raw;cd;DBG_GEN 5.3.0crc16pabU~crcval iunsigned short~uint16_tunsigned charuint8_tinthash&bbU(p%size% hash,~hash_tvoid hash_initCb'dUrndFiFjFmFrnddevGunsigned __FILE _cnt# _ptr# _base# _flag# _file# __orientation#  __ionolock#   __seekable#   __extendedfd#   __xf_nocheck#   __filler#  FILElong  crc16_tableƈ"  shuffle_tableƇ"crc16_polyć"fcntlAcharA__posix_ttyname_r}I__posix_getlogin_rIpid_tgetpid__posix_ctime_rII tm$ tm_sec# tm_min# tm_hour# tm_mday# tm_mon# tm_year# tm_wday# tm_yday# tm_isdst# __posix_asctime_rIItime_ttimesrandrandfileno/ size_tfread4n/44AAnAxfopens}fclose,Hmem.c /var/tmp/fprobe-1.1/src /opt/solstudio12.2/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c mem.c -W0,-xp.XAKgoyLCYMLOkE1.Xa;g;R=Sun C 5.11 SunOS_i386 145355-01 2010/10/11;G=.XAKgoyLCYMLOkE1.;backend;raw;cd;DBG_GEN 5.3.0unsigned short/uint16_tunsigned charPuint8_t__pthread_mutex_flag1A#__pthread_mutex_flag2a#__pthread_mutex_ceilinga#__pthread_mutex_typeA#__pthread_mutex_magicA#longa'K__pthread_mutex_pad#unsignedKuint32_t__pthread_ownerpidW#__pthread_lockwordW#unsigned long longupad64_t/__pthread_mutex_lock64'#__pthread_mutex_lock32f#__pthread_mutex_owner64# _pthread_mutex__pthread_mutex_flagso#__pthread_mutex_lock#__pthread_mutex_data#/pthread_mutex_t mem_mutex mem_alloc%0deUD< iK& mptrI' iptr( eptrD*void < N MemnextI#freeK#firstD#lastD# Dmem_index_t  mem_freenefUDeptrm iptro mptrIp pptrp Imem_initfOgUiiKelementKbulk Klimitint malloc_sizeK"̊" element_table_sizeK!܊" mem_index_table_sizeK Њ"total_memoryK" limit_memoryKȊ" bulk_quantityKԊ" element_sizeK؊"free_elementsKĞ"total_elementsK" rootI" /pthread_mutex_unlockipthread_mutex_locki char __posix_ctime_r tm$tm_seci#tm_mini#tm_houri#tm_mdayi# tm_moni#tm_yeari#tm_wdayi#tm_ydayi#tm_isdsti#  __posix_asctime_r i___errnofreeDcallocDKKCmy_getopt.c /var/tmp/fprobe-1.1/src /opt/solstudio12.2/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c my_getopt.c -W0,-xp.XAKgoyLCYMLOEI1.Xa;g;R=Sun C 5.11 SunOS_i386 145355-01 2010/10/11;G=.XAKgoyLCYMLOEI1.;backend;raw;cd;DBG_GEN 5.3.03my_getoptPggjUargcargv jparmscipflagmy_opterroptstringw"intchar getopt_parmsj name # flag# count# arg# !long  o  getopt   unsigned charunsigned__FILE _cnt# _ptr# _base# _flag# _file# __orientation# __ionolock#  __seekable#  __extendedfd#  __xf_nocheck#  __filler#    fprintf   __posix_ttyname_r    __posix_getlogin_rJ  oJ __posix_ctime_r| O tm$ tm_sec# tm_min# tm_hour# tm_mday# tm_mon# tm_year# tm_wday# tm_yday# tm_isdst# |__posix_asctime_r  7xmy_log.c /var/tmp/fprobe-1.1/src /opt/solstudio12.2/prod/bin/cc -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include -g -D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT -c my_log.c -W0,-xp.XAKgoyLCYMLOUJ1.Xa;g;R=Sun C 5.11 SunOS_i386 145355-01 2010/10/11;G=.XAKgoyLCYMLOUJ1.;backend;raw;cd;DBG_GEN 5.3.0$char5long=YBmy_log_namesJ = Bmy_log_namest  my_log_openpjjU =indent min_level flagsunsigned my_log_close$jjU my_log)jvkU level( format( ...(args*msg+msg_prefix, 5voidva_list5B5@B?my_log_flags"my_log_min_level"my_log_indent=" 5NintvsnprintfX=S 5snprintfX= unsigned char__FILE_cntX#_ptr#_base#_flag# _file# __orientation# __ionolock#  __seekable#  __extendedfd#  __xf_nocheck#  __filler#   5fprintfX closelog 5syslogX 5openlogXX, /var/tmp/fprobe-1.1/src/usr/include/sys/usr/include./usr/include/netinet/usr/local/include/pcap/usr/include/isofprobe.cstat_impl.hstat.htypes.hstdlib.hstdio.htime_impl.hfprobe.hmy_getopt.hnetflow.hint_types.hpwd.htime.hhash.hin.hpcap.hbpf.hip.hnetdb.hsocket_impl.hbyteorder.hsignal.hselect.hstdio_impl.hstdio_iso.hsched.htime_iso.h000 000 000 11#1 0131^1 j1 p1s1x1 1 1}1 111 1 1 112  2&2:2 @2F2h2 |2 222 2 2 2 2 2 2 2 3 3  3 ,3 >3 P3 \3 `3f3w3 33 33 33 3w4 4 '4o34D4 J4 P4V4]4o44 4 4 4 4 4 44 5  5;5 M5 h5 z5 5 5 5 5 55 5 5 6 6 .6 J6 V6 q6}6 666 6 6 6667  7 7 7(7 17 87D7 M7 T7`7 i7 p77 7 77 7 77 7 78 !8 (868 ?8 D8R8 [8 `8m8 t8 |88 8 88 8 88 8 88 9 9*9 39 89P9 Y9 `99 9 99 9 9 9 9 99 9 99 9 :$: 8::|:: ;;;; ;; ; ; ; < < <z"< *< 7<F<P< _< o<< < < < < < = #= 9= `= = = = = (> 0> d>r> {> > > > > > >b?#(? 8? B?H? P?V?]? l?~? ? ? ?}? ? ? ?? @@ @ @*@ 6@ L@ Z@o@ @ @ @ @ @ @@ @ @ A  A A AAAMA \A hA pAA A AA AWA+AQA1A A B BBv'B,B 0B6BHBTB cBBBB BBBB B C C C &C 0C :C DC PC \C nC C C CC C C D .D=D KD jD yD DD DD D DD E E E E  E4E_\E(E EE E EEE E F !F0FKF _F iF zF F F F F F FF F G  GG{ G FG ]G gG G G G G G H 2H N dN pN N N O 'O MO hO O O OOO O OOuPP LP P PP P Q 5Q NQ ZQ Q Q Q  R RR R R S S#S :S QS hS lS|SsSS SS S ST 5T KT WTeT T T T TT T T  U U EU hU~U U U U U U|UV V $V 0V >V HV nV V V V V V V W W iWsWW W W W X 9X EX RXzXX X X X X X X Y'Y JY VYjY tY Y Y YYY Z Z #Z RZ uZ ZZ Z Z Z Zs["[ 3[ V[ b[ [ [ [ [ \ \K\ p\ \ \\ \ \'^ C^ H^ R^ T^ ^^ `^z^^ h_u__ _ _ _` ` &` ?`^` k` z` ` ` ` ` ` ` ` ` `n%a5aKajd /var/tmp/fprobe-1.1/src/usr/include/sys.netflow.cint_types.hnetflow.h /var/tmp/fprobe-1.1/src/usr/include/sys./usr/include/usr/include/isohash.cint_types.hhash.hstdio_impl.hstdio_iso.htypes.htime_iso.hpavaa a a b b bb+b:b mbwb b bbb c c &c Ic Wc hc c c~cc c c d d|"d /var/tmp/fprobe-1.1/src/usr/include/sys./usr/include/isomem.ctypes.hint_types.hmem.htime_iso.h0d6d-Ed Sd pdwd d d d d d d d d}d e e -e =e Fe ]e ie qeze |ee e e e e e e e eef f f ,f 2f ;f~QfZf ifvf f ff f f f ff fff g g (g ;g CgJg  /var/tmp/fprobe-1.1/src./usr/include/usr/include/isomy_getopt.cmy_getopt.hstdio_impl.htime_iso.hPgVgg g g g g h  h|'h1hIh Ph lh th~h h h h h h h{iii 3i :i ^isi }i i i i i j j 0j  &III: I  !I/  :  I8 I  4I?  : ;  I!I4I : ;  4I : ;  :  : !I/.?  : ;@ D .?  : ;@ ' D I: ; .?  : ;@ ' ID D D .?  : ;@ ID  I8 .?  : ;@ ID .?  6 : ;@ ' ID D ' D I !!I/"< #.? < ' ID $I%.? < ' D &.? < ID '.? < D ()' ID *' D +.? < ' ID ,.? < ' ID  DD%$> I: I!I4I : ;  I !I/ I  :  I8 4I?  : ;   DD%.?  : ; @ ' ID I: ;  4I : ;  $> I: I.?  : ; @ D   :  I8 I8 I  !I/.? < ' ID I.? < ' ID &I.? < ' D .? < ' ID  DD%$> I:  :  I8 I !I/  :   :  4I : ;  .?  : ; @ ID  I .?  : ; @ ' D I: ;  .?  : ; @ ' ID 4I?  : ;  .? < ' ID I&I.? < ID .? < ' D .? < ' ID  DD%.?  : ; @ ' ID I: ;  4I : ;  $> I&I :  I8 I  !I/ .? < ' ID  I I8 .? < ' ID  DD%$> II!I4I : ;  I !I/ .?  : ; @ ' D  I: ;  .?  : ; @ ' D  &II: I !I/.? < ' ID I :  I8  I8 .? < ' D .? < ' D .? < ' D  1Ldlt usage sighandler1 gettime cmpmtimegetuptimeOhash_flow%copy_flowmfindput_into}fillemit_threadunpending_threadnscan_threadpcap_callbackpcap_thread0main5 1CNetFlow1NetFlow5)NetFlow7/M51crc16hash-hash_initl<0mem_allocmem_freemem_inittotal_memory<free_elementsYtotal_elements5DG;my_getopt:|I;my_log_openmy_log_close!my_log5 15statlstat+fstatgmknodm 1dev_tino_tmode_tnlink_tuid_tgid_toff_ttime_t*timespecZtimestruc_tlblksize_t|blkcnt_tstatDLT_getopt_parmsuint16_tNetFlowuint8_t%uint32_t \ upad64_tk _pthread_mutex@ pthread_mutex_t _pthread_cond2 pthread_cond_t0 passwdq Time suseconds_t timevalhash_t$in_addrFFlowu_charbpf_u_int32pcap_pkthdr=uchar_tKushort_tZipu_intu_shortbpf_insnbpf_programsocklen_t,sa_family_tOsockaddraddrinfo0in_port_tQsockaddr_in_pthread_attrpthread_attr_t:Tsigset_ttsigactionpid_t.__FILE FILEpeersched_parampthread_tpcap_t$_pthread_mutexattr'ssize_t+size_t|-fd_set.tm' 1CIuint16_tBNetFlowmM5uint16_tuint8_thash_t__FILEFILEpid_ttmtime_t4size_t<0Auint16_tauint8_to'Wuint32_tfupad64_t/_pthread_mutexpthread_mutex_tNMemmem_index_ttm15DG!getopt_parms__FILE|tm%|I;va_list__FILE 1parmsparmsfilterscan_interval"frag_lifetime>inactive_lifetime^active_lifetime|bulk_quantitypending_queue_lengthnetflowverbositylog_destlink_layer_sizeV unpending_mutexG unpending_conde scan_mutex scan_cond emit_mutex emit_cond ident emit_timeout unpending_timeout pw'threadskilledpidpidfilepathpidfile1flows_emitKscan_frag_dregipending_tailpending_headflows_mutexflowssigsfpeers{npeers_rotnpeerssched_maxsched_minTschedpjsig_maskthidpcap_handleemit_packet emit_time! emit_rate_delay@ emit_rate_bytes_ emit_sequence| emit_count off_tl off_nl start_time_offset start_time link_layer!snmp_output_index8!snmp_input_indexX!sockbufsizer!dev!promisc 1CoNetFlow1_HeaderNetFlow1_HeaderNetFlow1_FlowNetFlow1_FlowNetFlow5_Header4NetFlow5_HeaderRNetFlow5_FlowNetFlow5_FlowNetFlow7_HeaderNetFlow7_HeaderNetFlow7_FlowNetFlow7_Flow?M5crc16_tableshuffle_table crc16_poly<0mem_mutexpmalloc_sizeelement_table_sizemem_index_table_sizelimit_memorybulk_quantity!element_sizewroot35DGflagmy_opterroptstringh|I;Ymy_log_namesmy_log_namesmy_log_flagsmy_log_min_level2my_log_indent.interp.SUNW_cap.hash.dynsym.dynstr.SUNW_version.rel.data.rel.bss.rel.plt.text.init.fini.rodata.rodata1.got.dynamic.bssf.symtab.strtab.annotate.comment.debug_info.debug_line.debug_abbrev.debug_pubnames.debug_funcnames.debug_typenames.debug_varnames.shstrtab o4 LL`!")oL&L&7 B&&A B&& J B'' N))S//;Yxkxk_kkekkmkk vpwpwt{xx;yyX,,E00,L <o0NM.6/899 ">  ,D07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000b00000000TRAILER!!!