Hello
reading the source code (lib/ftlib.h) I seems to me that the exporter is
saved when capturing from multiple flows. I refer to the following
extructure:
struct fts3rec_v5_gen {
u_int32 unix_secs; /* Current seconds since 0000 UTC 1970 */
u_int32 unix_nsecs; /* Residual nanoseconds since 0000 UTC 1970 */
u_int32 sysUpTime; /* Current time in millisecs since router booted */
u_int32 exaddr; /* Exporter IP address */
u_int32 srcaddr; /* Source IP Address */
u_int32 dstaddr; /* Destination IP Address */
u_int32 nexthop; /* Next hop router's IP Address */
u_int16 input; /* Input interface index */
u_int16 output; /* Output interface index */
u_int32 dPkts; /* Packets sent in Duration */
u_int32 dOctets; /* Octets sent in Duration. */
u_int32 First; /* SysUptime at start of flow */
u_int32 Last; /* and of last packet of flow */
u_int16 srcport; /* TCP/UDP source port number or equivalent */
u_int16 dstport; /* TCP/UDP destination port number or equiv */
u_int8 prot; /* IP protocol, e.g., 6=TCP, 17=UDP, ... */
u_int8 tos; /* IP Type-of-Service */
u_int8 tcp_flags; /* OR of TCP header bits */
u_int8 pad;
u_int8 engine_type; /* Type of flow switching engine (RP,VIP,etc.) */
u_int8 engine_id; /* Slot number of the flow switching engine */
u_int8 src_mask; /* mask length of source address */
u_int8 dst_mask; /* mask length of destination address */
u_int16 src_as; /* AS of source address */
u_int16 dst_as; /* AS of destination address */
};
am I right? If so, how I can print the exporter of a netflow v5 format when
using flow-print?
Thanks
Ulisses
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
