-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Colin,
- --On February 26, 2007 1:32:47 +0000 Colin Whittaker <[EMAIL PROTECTED]>
wrote:
| I have two sources of netflow data each with multiple interfaces
| generating netflow data.
| I want to use a filter to identify which interfaces contain interesting
| traffic. In this case interface 17 and 12 for source1 and interface 2
| for source2. At the minute the interface numbers are not overlapping and
| so one filter rule works.
| But as I increase the number of sources I expect this not to work any
| more so I want to be able to identify the source in the filter if possible.
You can additionally filter according the source identifier:
( ident source1 and (in if 17 or in if 12)) of ( ident source2 and ( in if ... )
So interface numbers will not collide from different sources.
- Peter
|
| currently running snapshot-20060809
|
| nfdump -R profiles/live/source1/2007/02/25/ -R
| profiles/live/source2/2007/02/25/ -s record/bytes -n 50 -A srcas -o
| "fmt:%sas %byt" "in if 17 or in if 12 or in if 2"
|
| Colin
| --
| Colin Whittaker +353 (0)86 836 4509
| http://www.magnet.ie [EMAIL PROTECTED]
|
| -------------------------------------------------------------------------
| Take Surveys. Earn Cash. Influence the Future of IT
| Join SourceForge.net's Techsay panel and you'll get the chance to share your
| opinions on IT & business topics through brief surveys-and earn cash
| http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
| _______________________________________________
| Nfdump-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBReLauf5AbZRALNr/AQIhDQP/Wcj7Ard4DMxAS+pBQQ34lOFk7OKufVr7
P+omNAryha71n3g/a/ztKyo6702v7fAneM/bqZQdE0lZIcVZhgT384vkzOFziKOO
Njo5vi9ymXJWpWYbno2AEdlwNMyUFXPY8h9g3RoE0Ec//zcYXiIhp70XdCR0zDcu
/d7zbkPLFzo=
=yOuH
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
