Hi, folks.
I have a strange issue on my core router Foundry BigIron 8000 with
sFlow export. I see only inbound traffic on sFlow samples:
host 206.53.60.34 is in my network (Also i did this test with other
hosts).
# sflowtool -p 3000 -t | tcpdump -nr - dst host 206.53.60.34
reading from file -, link-type EN10MB (Ethernet)
15:04:53.000000 IP 82.128.3.52.45013 > 206.53.60.34.80: . ack 24619974
win 17520 <nop,nop,timestamp 36603788 4211256578>
15:04:54.000000 IP 24.174.11.206.3373 > 206.53.60.34.80: P
1199114572:1199115084(512) ack 1789266672 win 64240 <nop,nop,timestamp
532058 4211258399>
15:04:58.000000 IP 85.104.28.86.1351 > 206.53.60.34.80: . ack 79673712
win 62788
15:04:58.000000 IP 81.208.106.73.57498 > 206.53.60.34.80: . ack
1730139818 win 17520
15:04:59.000000 IP 65.69.142.208.62916 > 206.53.60.34.80: . ack
3847022661 win 65535
15:04:59.000000 IP 61.68.133.228.3536 > 206.53.60.34.80: . ack
1335280708 win 8760
15:05:00.000000 IP 213.189.177.40.3402 > 206.53.60.34.80: . ack
3962404067 win 16153
15:05:01.000000 IP 82.169.132.243.22872 > 206.53.60.34.80: P
2078249237:2078249560(323) ack 2864397975 win 63592
^Ctcpdump: pcap_loop: error reading dump file: Interrupted system call
# sflowtool -p 3000 -t | tcpdump -nr - src host 206.53.60.34
reading from file -, link-type EN10MB (Ethernet)
^Ctcpdump: pcap_loop: error reading dump file: Interrupted system call
Here is output from "sh sflow" command: