On 21/8/12 9:20 PM, Bojan Zdrnja (SANS ISC) wrote:
> Hi Peter,
>
> On Tue, Aug 21, 2012 at 8:55 PM, Peter Haag <ph...@users.sourceforge.net>
> wrote:
>> Hi Bojan,
>> Thanks for your feedback.
>
> You're welcome :)
>
>>> - add statistics calculation per time as well (for example, per
>>> second). It would be nice to be able to calculate flows or bytes per
>>> interface per second (not possible at the moment unless I'm missing
>>> something).
>>
>> Hmm .. not sure, but if you run: ./nfump -s inif -r
>> you get a statistics per interface and the rates pps, bps etc.
>> Does that do your job, or do you miss something here?
>
> That will give me total statistics per interface. However, I'd like to
> see statistics per time slots - for example per seconds. That will
> allow me to identify when exactly (for example) spikes happened and do
> a lot of other calculations/post processing that I currently do with
> extra programs that parse non-aggregated information generated by
> nfdump.
Ahh - got it! But how would you set these - for example - second intervals.
Flows have a start/end time and may fall into multiple slots. How do you
do your postprocessing right now?
Cheers
- Peter
>
> Cheers,
>
> Bojan
>
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
