-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Phil,
I just mean netflow v9 field 61 Direction as specified in RFC3954. 0 means this flow is incoming, 1 indicates this flow is outgoing. The %out and %in fields just says on which interface they entered/leaved, however matching that on collector side to overall incoming/outgoing traffic is much more difficult than assigning this on the probe side. Cheers, Dani On 06/07/2011 10:29 AM, Phil Mayers wrote: > On 06/03/2011 03:20 PM, Daniel Aschwanden wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA256 >> >> Hi all, >> >> Currently, I'm struggling a bit with the direction indication of nfdump, >> which marks all my flows as incoming. > > What do you mean by "direction" and "incoming"? > > The %out and %in format arguments are the values of the output and input > interface indices of a flow, respectively. > > They do not refer to "direction", although to be honest I'm not sure > what direction means, or you think it means. > > Are you referring to the difference between ingress and egress netflow? > > Or by direction do you mean "client" and "server" roles of the two nodes > whose traffic a flow refers to? > > ------------------------------------------------------------------------------ > EditLive Enterprise is the world's most technically advanced content > authoring tool. Experience the power of Track Changes, Inline Image > Editing and ensure content is compliant with Accessibility Checking. > http://p.sf.net/sfu/ephox-dev2dev > _______________________________________________ > Nfdump-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfdump-discuss - -- daniel aschwanden junior engineer open systems ag raeffelstrasse 29 ch-8045 zurich t: +41 44 455 74 96 f: +41 44 455 74 01 [email protected] http://www.open.ch -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAk3t9hUACgkQxIzmH53Qg6HjSwD9HW8/PBV1bZp9SWzixw8IWyQ4 rUPJTpCLtJ9bXREQJL0A/Aq+bfXdFHyXHsXB4IPy5GZep/zQqV6qKVGvv/O/dDrl =7vIH -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev _______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
