I think i get the answer by myself, maybe it is a bug for flow-stat and flow-report. This problem will appear in the case below:
module options description
flow-stat -P show percent
-f11(or f7, f26) Source or Destination IP/Prefi, UDP/TCP port
flow-report options +percent-total show percent
type ip-address(or ip-port) IP Address (both source and destination)
IP Port (both source and destination)
The correct percent value is a half of the original field because both source and destination IPAddr(or Port) are counted. For example, when execute "flow-cat ft-v05.2005-07-13.135000+0800 | flow-stat -P -S2 -f11 | head -100", the result is:
# Args: flow-stat -P -S2 -f11
#
#
# IPaddr flows octets packets
#
192.168.0.202 58.167 65.394 64.727
222.64.174.109 0.133 9.878 5.228
218.82.9.22 0.930 8.564 2.985
192.168.0.58 6.972 8.168 5.957
192.168.0.253 3.718 7.183 4.100
192.168.0.238 5.843 4.392 7.167
192.168.0.147 4.582 4.297 4.540
220.166.118.3 0.598 3.880 1.720
The percent field of flows, octets and packets should divide by 2.
I wish the bug will be fixed in the next release.
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
