-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Peter, Hi Ed
Thanks for pointing me to Nfseight. In my eyes, it looks like the direction bit is set correctly in the netflow packages. So I've attached a small pcap file with some netflow packets in it. Any feedback or recommendation is highly appreciated. Cheers, Dani > This all depends on your exporting device. netflow originally by design is > unidirectional only. Depending on your router > software and configuration, routers can recognise the direction of a flow. > However, on lots of devices this bit is > unused and set to zero, which is equal to 'incoming'. > > Maybe someone else knows exactly which devices/software releases are capable > of handling this bit correctly. Devices, > which support FNF ( flexible netflow ) from CISCO should be able to handle > directions correctly. > > Regards > > - Peter > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAk3tySsACgkQxIzmH53Qg6EAZQD+P5+hFIIZkcn50/yPf+Jn50vX k6tlkE1qdRHG9PFa5SIA/18ZBq/rK0ApHHwgEosQ+kg/3e9p+rw45ktdjQn8qdTX =8lwK -----END PGP SIGNATURE-----
direction_an.pcap
Description: application/cap
------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev
_______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
