{"action":"reopened","issue":{"url":"https://api.github.com/repos/ntop/ntopng/issues/505","repository_url":"https://api.github.com/repos/ntop/ntopng","labels_url":"https://api.github.com/repos/ntop/ntopng/issues/505/labels{/name}","comments_url":"https://api.github.com/repos/ntop/ntopng/issues/505/comments","events_url":"https://api.github.com/repos/ntop/ntopng/issues/505/events","html_url":"https://github.com/ntop/ntopng/issues/505","id":149465125,"number":505,"title":"Malformed traffic from nprobes over ZMQ","user":{"login":"Queeq","id":3294985,"avatar_url":"https://avatars.githubusercontent.com/u/3294985?v=3","gravatar_id":"","url":"https://api.github.com/users/Queeq","html_url":"https://github.com/Queeq","followers_url":"https://api.github.com/users/Queeq/followers","following_url":"https://api.github.com/users/Queeq/following{/other_user}","gists_url":"https://api.github.com/users/Queeq/gists{/gist_id}","starred_url":"https://api.github.com/users/Queeq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Queeq/subscriptions","organizations_url":"https://api.github.com/users/Queeq/orgs","repos_url":"https://api.github.com/users/Queeq/repos","events_url":"https://api.github.com/users/Queeq/events{/privacy}","received_events_url":"https://api.github.com/users/Queeq/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ntop/ntopng/labels/testing%20needed","name":"testing needed","color":"fef2c0"}],"state":"open","locked":false,"assignee":{"login":"lucaderi","id":4493366,"avatar_url":"https://avatars.githubusercontent.com/u/4493366?v=3","gravatar_id":"","url":"https://api.github.com/users/lucaderi","html_url":"https://github.com/lucaderi","followers_url":"https://api.github.com/users/lucaderi/followers","following_url":"https://api.github.com/users/lucaderi/following{/other_user}","gists_url":"https://api.github.com/users/lucaderi/gists{/gist_id}","starred_url":"https://api.github.com/users/lucaderi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucaderi/subscriptions","organizations_url":"https://api.github.com/users/lucaderi/orgs","repos_url":"https://api.github.com/users/lucaderi/repos","events_url":"https://api.github.com/users/lucaderi/events{/privacy}","received_events_url":"https://api.github.com/users/lucaderi/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2016-04-19T13:42:57Z","updated_at":"2016-04-22T07:59:24Z","closed_at":null,"body":"Running latest nightlies on VMWare virtual machine Ubuntu 14.04, kernel 4.4.6.\r\n\r\nThere are 6 nprobe instances receiving IPFIX from Juniper routers and 1 ntopng instance which connects to nprobes over TCP (everything's within the same VM). It had been working fine on the same version before I restarted it several times today (both nprobes and ntopng).\r\n\r\nNprobes are run with these parameters:\r\n```\r\nnprobe --collector-port 2055 --zmq tcp://127.0.0.1:5556 --daemon-mode -n none -i none --aggregation 0/1/1/1/0/0 --sample-rate @4096:1\r\n```\r\n\r\nNtopng verbose mode shows many messages like these:\r\n```\r\n19/Apr/2016 16:37:23 [CollectorInterface.cpp:183] [225] �4�\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 15/15\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 10/10\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 14/14\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 5/5\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 16/16\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 17/17\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 9/9\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 13/13\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 42/42\r\n19/Apr/2016 16:37:23 [CollectorInterface.cpp:183] [222] 0�4�\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 15/15\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 10/10\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 14/14\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 5/5\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 16/16\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 17/17\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 9/9\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 13/13\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 42/42\r\n19/Apr/2016 16:37:23 [CollectorInterface.cpp:183] [223] P�*�\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 15/15\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 10/10\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 14/14\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 5/5\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 16/16\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 17/17\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 9/9\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 13/13\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 42/42\r\n19/Apr/2016 16:37:23 [CollectorInterface.cpp:183] [223]  .5�\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 15/15\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 10/10\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 14/14\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 5/5\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 16/16\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 17/17\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 9/9\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 13/13\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 42/42\r\n19/Apr/2016 16:37:23 [CollectorInterface.cpp:183] [222] �h5�\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 15/15\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 10/10\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 14/14\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 5/5\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 16/16\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 17/17\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 9/9\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 13/13\r\n19/Apr/2016 16:37:23 [ParserInterface.cpp:671] Not handled ZMQ field 42/42\r\n19/Apr/2016 16:37:23 [CollectorInterface.cpp:183] [223] �5�\r\n```\r\n\r\nSniffing traffic on loopback interface gives this:\r\n```\r\n➜ tcpdump -ni lo -c 10 port 5558 -vvv\r\ntcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes\r\n16:40:58.327107 IP (tos 0x0, ttl 64, id 6300, offset 0, flags [DF], proto TCP (6), length 213)\r\n    127.0.0.1.5558 > 127.0.0.1.44092: Flags [P.], cksum 0xfec9 (incorrect -> 0x6d32), seq 3570775324:3570775485, ack 863861716, win 342, options [nop,nop,TS val 236039850 ecr 236039600], length 161\r\n16:40:58.327116 IP (tos 0x0, ttl 64, id 53387, offset 0, flags [DF], proto TCP (6), length 52)\r\n    127.0.0.1.44092 > 127.0.0.1.5558: Flags [.], cksum 0xfe28 (incorrect -> 0x01fd), seq 1, ack 161, win 367, options [nop,nop,TS val 236039850 ecr 236039850], length 0\r\n16:40:58.900747 IP (tos 0x0, ttl 64, id 6301, offset 0, flags [DF], proto TCP (6), length 8244)\r\n    127.0.0.1.5558 > 127.0.0.1.44092: Flags [P.], cksum 0x1e29 (incorrect -> 0xdf11), seq 161:8353, ack 1, win 342, options [nop,nop,TS val 236039993 ecr 236039850], length 8192\r\n16:40:58.900779 IP (tos 0x0, ttl 64, id 53388, offset 0, flags [DF], proto TCP (6), length 52)\r\n    127.0.0.1.44092 > 127.0.0.1.5558: Flags [.], cksum 0xfe28 (incorrect -> 0xdcdf), seq 1, ack 8353, win 1390, options [nop,nop,TS val 236039993 ecr 236039993], length 0\r\n16:40:58.900812 IP (tos 0x0, ttl 64, id 6302, offset 0, flags [DF], proto TCP (6), length 8244)\r\n    127.0.0.1.5558 > 127.0.0.1.44092: Flags [P.], cksum 0x1e29 (incorrect -> 0x92a4), seq 8353:16545, ack 1, win 342, options [nop,nop,TS val 236039993 ecr 236039993], length 8192\r\n16:40:58.900817 IP (tos 0x0, ttl 64, id 53389, offset 0, flags [DF], proto TCP (6), length 52)\r\n    127.0.0.1.44092 > 127.0.0.1.5558: Flags [.], cksum 0xfe28 (incorrect -> 0xb8e0), seq 1, ack 16545, win 2413, options [nop,nop,TS val 236039993 ecr 236039993], length 0\r\n16:40:58.900839 IP (tos 0x0, ttl 64, id 6303, offset 0, flags [DF], proto TCP (6), length 8244)\r\n    127.0.0.1.5558 > 127.0.0.1.44092: Flags [P.], cksum 0x1e29 (incorrect -> 0xa0a3), seq 16545:24737, ack 1, win 342, options [nop,nop,TS val 236039993 ecr 236039993], length 8192\r\n16:40:58.900846 IP (tos 0x0, ttl 64, id 53390, offset 0, flags [DF], proto TCP (6), length 52)\r\n    127.0.0.1.44092 > 127.0.0.1.5558: Flags [.], cksum 0xfe28 (incorrect -> 0x94e1), seq 1, ack 24737, win 3436, options [nop,nop,TS val 236039993 ecr 236039993], length 0\r\n16:40:58.900867 IP (tos 0x0, ttl 64, id 6304, offset 0, flags [DF], proto TCP (6), length 8244)\r\n    127.0.0.1.5558 > 127.0.0.1.44092: Flags [P.], cksum 0x1e29 (incorrect -> 0xe6f5), seq 24737:32929, ack 1, win 342, options [nop,nop,TS val 236039993 ecr 236039993], length 8192\r\n16:40:58.900872 IP (tos 0x0, ttl 64, id 53391, offset 0, flags [DF], proto TCP (6), length 52)\r\n    127.0.0.1.44092 > 127.0.0.1.5558: Flags [.], cksum 0xfe28 (incorrect -> 0x741e), seq 1, ack 32929, win 3631, options [nop,nop,TS val 236039993 ecr 236039993], length 0\r\n10 packets captured\r\n```\r\nNote packet length of 8192 from nprobe. During normal operation I noticed it was sending packets 150-200 bytes long."}}