I am currently in the process of playing with flow-capture and the compression settings therein, but as far as I can tell the -z option makes no difference to the size of the flow files eventually stored. Curious about this, I ran a brief test:
[EMAIL PROTECTED] ~/temp]$ for i in 0 1 2 3 4 5 6 7 8 9 ; do flow-gen -n10000 -z${i} > test.${i} ; done
[EMAIL PROTECTED] ~/temp]$ ls -l test.*
-rw-r--r-- 1 netflow netflow 640048 Apr 6 15:37 test.0
-rw-r--r-- 1 netflow netflow 164616 Apr 6 15:37 test.1
-rw-r--r-- 1 netflow netflow 163558 Apr 6 15:37 test.2
-rw-r--r-- 1 netflow netflow 164008 Apr 6 15:37 test.3
-rw-r--r-- 1 netflow netflow 177949 Apr 6 15:37 test.4
-rw-r--r-- 1 netflow netflow 177434 Apr 6 15:37 test.5
-rw-r--r-- 1 netflow netflow 177260 Apr 6 15:37 test.6
-rw-r--r-- 1 netflow netflow 177251 Apr 6 15:37 test.7
-rw-r--r-- 1 netflow netflow 178164 Apr 6 15:37 test.8
-rw-r--r-- 1 netflow netflow 178156 Apr 6 15:37 test.9
Clearly the -z level should make an appreciable difference in the files stored by flow-capture.
A little further digging revealed this line in flow-gen.c:
flow-gen.c:160 ftio_set_z_level(&ftio, ftset.z_level);
However, the flow-capture.c code (lines 725-729 are the relevant ones as far as I can tell) contain no reference to the set_z_level() function.
Does the appropriate line need inserting here to actually enable compression on the stored flow files?
I should note this is all using flow-tools v0.67.
Thanks in advance and my apologies if I have missed something obvious
Ras
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
