Hello,
Thanks for your reply,
I have use the option "-T +14" to store the router ID (nfcapd -p 9999 -l
/root/testNetFlow/ -T +14)
Now I will try to extract this extension with nfdump.
Thanks a lot again.
Cordialement.
Vincent MONNIER
Customer & Partner Support
UBIqube Solutions
Smart Security Services
Parc Sud Galaxie
5 rue des Tropiques
38130 Echirolles
France
Ph: +33 438498369
+33 426691592
Fax: +33 438498361
www.ubiqube.com
-----Message d'origine-----
De : Peter Haag [mailto:[email protected]]
Envoyé : Tuesday, October 12, 2010 1:43 PM
À : Vincent MONNIER
Cc : [email protected]
Objet : Re: [Nfdump-discuss] nfcapd with diffrents source of Netflow Flows
On 10/11/10 11:53, Vincent MONNIER wrote:
> Hello,
>
> I just began to use nfdump and my first question is regarding the ability of
> nfcapd to deal with many different routers. In the documentation I have found
> 2 ways to achieve this:
>
> 1. The Fisrt way is to dedicated a nfcapd process per router on a
> specific port, like below
> nfcapd -p 10001 -l /netflow/spool/router1
> nfcapd -p 10002 -l /netflow/spool/router2
> ...
> nfcapd -p 1000N -l /netflow/spool/routerN
>
>
>
>
>
> 2. The second is with only one nfcapd process, with parameter -n for
> each router source
> nfcapd -p 9999 -n router1,192.168.1.1, /netflow/spool/router1 -n
> routeur2,192.168.1.2, /netflow/spool/router2, .... -n routeurN,192.168.1.N,
> /netflow/spool/routerN
>
>
>
> My question is, is there a way to not filter take care of the source router
> during the capture with nfcapd to do it with nfdump ? . I have seen that the
> router id is send in the netflow message, is this information stor in the
> nfdump data and can be reuse after ?
Yes - see nfcapd(1) to enable the appropriate tags to store the router ID.
There is no possibility to filter flows while
collecting. It may be a future option. Use nfdump to filter to flows. The
router tag can be used too in filters.
- Peter
>
> Thanks in advance.
>
> Monnier Vincent
>
>
>
>
> ------------------------------------------------------------------------------
> Beautiful is writing same markup. Internet Explorer 9 supports
> standards for HTML5, CSS3, SVG 1.1, ECMAScript5, and DOM L2 & L3.
> Spend less time writing and rewriting code and more time creating great
> experiences on the web. Be a part of the beta today.
> http://p.sf.net/sfu/beautyoftheweb
>
>
>
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
--
--
Be nice to your netflow data
------------------------------------------------------------------------------
Beautiful is writing same markup. Internet Explorer 9 supports
standards for HTML5, CSS3, SVG 1.1, ECMAScript5, and DOM L2 & L3.
Spend less time writing and rewriting code and more time creating great
experiences on the web. Be a part of the beta today.
http://p.sf.net/sfu/beautyoftheweb
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
