Ok ... I juste understood my misunderstanding. I'm so stupid ! Let's take a http request as example :
ip_address_source:X -> ip_address_destination:80 (A octets) (GET ....) and the server will reply : ip_address_destination:80 -> ip_address_source:X (B octets) (200 OK ...) So, this will make 2 different flow. Upload will be A and download will be B. * Hope it will help idiots like me... Thanks anyway Le Wednesday 16 April 2008 12:11:24 Guillaume Van der Schueren g, vous avez écrit : > Hello, > > This is my first post. After many searches on Google and this mailing list, > I couldn't find what I was looking for, so I tought I'd better ask > directly. Maybe I haven't searched far enough, and maybe I should have > posted on flowscan's mailing list. If so, please pardon me. > > Here is the situation : > > I have a computer configured as a bridge sitting behind my internet gateway > : LAN <-----> eth0-[ BRIDGE br0 ]-eth1 <-----> GATEWAY > This computer is running flowscan, flow-capture and fprobe, sniffing on > eth1. The flow files are created and I can read them with flow-cat, > flow-print & co. flowscan/cuflow also works like a charm, creating "dst" > and "src" rrds files for each configured service. > > So, what's the problem ? > > Well, I would like to be able to use flow-tools (flow-print ?) to see > inbound AND outbound traffic for each flow. I guess it's possible, since > flowscan/cuflow creates "dst" and "src" rrd files with "out_bytes" > and "in_bytes" datasources in each. > BUT... flow-print only shows "octets" without differentiating > "output_octets" and "input_octets". > I read that I had to sniff on both interfaces to get this kind of > information, but how do you explain that flowscan is able, for each dst and > src, to get out_bytes and in_bytes ? > > This probably is my ignorance/misunderstanding in action. Please don't let > me stay in that state. > Thanks in advance. > > Regards, > Guillaume Van der Schueren > _______________________________________________ > Flow-tools mailing list > [EMAIL PROTECTED] > http://mailman.splintered.net/mailman/listinfo/flow-tools _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
