nfdump simply reports, what it finds in the flows. There is a bug in softflowd,
if you read flows from a pcap file.
- Peter
On 3/23/11 9:59, Matthias Teege wrote:
> Moin,
>
> I've collected some v9 flows with softflowd and nfdump 1.6.3p1. The raw
> output starts with:
>
> Flow Record:
> Flags = 0x00 Unsampled
> size = 44
> first = 1296570675 [2011-02-01 15:31:15]
> last = 1300865642 [2011-03-23 08:34:02]
>
> The "first seen" timestamp is wrong because I've started softflowd only an
> hour ago. It looks like a conversion problem between seconds and
> milliseconds. In a packet trace I can see that SysUptime is set to 4294967
> (ms) for instance. 1300865642 - 4294967 gives 1296570675. Either there is
> an error in nfdump, nfcapd or softflowd or I made a mistake in my setup.
>
> How do I get the right timestamp?
>
> Many thanks
> Matthias
>
> ------------------------------------------------------------------------------
> Enable your software for Intel(R) Active Management Technology to meet the
> growing manageability and security demands of your customers. Businesses
> are taking advantage of Intel(R) vPro (TM) technology - will your software
> be a part of the solution? Download the Intel(R) Manageability Checker
> today! http://p.sf.net/sfu/intel-dev2devmar
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
--
--
Be nice to your netflow data
------------------------------------------------------------------------------
Enable your software for Intel(R) Active Management Technology to meet the
growing manageability and security demands of your customers. Businesses
are taking advantage of Intel(R) vPro (TM) technology - will your software
be a part of the solution? Download the Intel(R) Manageability Checker
today! http://p.sf.net/sfu/intel-dev2devmar
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
