Thanks Dani for the pcap. I'll check that and will let you know about the
results.
- Peter
On 7/6/11 8:46 AM, Daniel Aschwanden wrote:
> Hi Peter, Hi Ed
>
> Thanks for pointing me to Nfseight.
>
> In my eyes, it looks like the direction bit is set correctly in the
> netflow packages. So I've attached a small pcap file with some netflow
> packets in it.
>
> Any feedback or recommendation is highly appreciated.
>
> Cheers,
> Dani
>
>
>> This all depends on your exporting device. netflow originally by design is
>> unidirectional only. Depending on your router
>> software and configuration, routers can recognise the direction of a flow.
>> However, on lots of devices this bit is
>> unused and set to zero, which is equal to 'incoming'.
>
>> Maybe someone else knows exactly which devices/software releases are capable
>> of handling this bit correctly. Devices,
>> which support FNF ( flexible netflow ) from CISCO should be able to handle
>> directions correctly.
>
>> Regards
>
>> - Peter
>
------------------------------------------------------------------------------
EditLive Enterprise is the world's most technically advanced content
authoring tool. Experience the power of Track Changes, Inline Image
Editing and ensure content is compliant with Accessibility Checking.
http://p.sf.net/sfu/ephox-dev2dev
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
EditLive Enterprise is the world's most technically advanced content
authoring tool. Experience the power of Track Changes, Inline Image
Editing and ensure content is compliant with Accessibility Checking.
http://p.sf.net/sfu/ephox-dev2dev
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
