Drew Weaver wrote: > > Is it possible to use nfdump to find the top ‘n’ source IPs with flows > that have a dstport of 25? > > I would like to see who the top SMTP talkers on the ole network are. > > Any advice? >
The following works for me: nfdump -M /your/netflow/directory -R file1:fileX -s srcip/flows 'dst port 25 and proto tcp' -- Devon ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 _______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
