On Fri, Dec 04, 2009 at 03:43:55PM +0100, Peter Haag wrote:
>
> I'm not aware of any fields, which export the run length. nfdump simply
> uses the sampling rate, which is announced the v5 header. In that case
> you can add the sampling rate manually ( see nfcapd(1) -s )
> I also recommend to use nfdump-1.6rc2 on Sourceforge.
Thank you Peter,
In the man page for 1.6rc1 it states:
" -s <rate>
Apply default sampling rate rate to all netflow records, unless
the sampling rate is announced by the exporting device. In that case
the announced sampling rate is applied."
Does 1.6rc2 alow the -s flag to take precedence, even if a sample rate is
supplied by the device?
Also, the version of PortTracker I have only compiles against 1.6rc1,
would it be possible to supply an updated version?
Many thanks for your time on this.
--
Alistair Cockeram
------------------------------------------------------------------------------
Join us December 9, 2009 for the Red Hat Virtual Experience,
a free event focused on virtualization and cloud computing.
Attend in-depth sessions from your desk. Your couch. Anywhere.
http://p.sf.net/sfu/redhat-sfdev2dev
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
