-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hoi Philippe,
You may use a singe command with an appropriate filter such as
for traffic towards a single IP:
nfdump -r .. -A dstip -o "fmt:%da %fl %pkt %byt" -s record 'dst ip <ip address>'
or towards a network
nfdump -r .. -A dstip4/24 o "fmt:%da %fl %pkt %byt" -s record 'dst net <net>/24'
In other words: Create a record statistics, set proper aggregation and filter
and
use a custom output format. Aggregation should match filter.
Hope this helps,
- Peter
- --On January 28, 2008 10:31:55 AM +0100 Philippe Strauss <[EMAIL PROTECTED]>
wrote:
| Hello,
|
| I'm trying to obtain a single line summary of the total number of
| bytes, packets, flows, toward a single IPv4 adress, or a single subnet
| in my network, but I must be dumb, I can't get "nfdump -A" working.
| All I get is a full dump of flows during this timeframe.
|
| I'm using
|
| nfdump -M /opt/nfsen/profiles-data/live/rt_cc_b1:rt_cc_b2 -T -R
| 2008/01/27/nfcapd.200801272200:2008/01/28/nfcapd.200801272205 -A dstip4
| 'host 12.34.56.78'
|
| Version:
| nfdump: Version: 1.5.6 $LastChangedDate: 2007-10-15 08:05:26 +0200 (Mon,
| 15 Oct 2007) $
| $Id: nfdump.c 95 2007-10-15 06:05:26Z peter $
|
| using -s (statistics), the summary line doesn't seem to "integrate" over
| all flows.
|
| What am i doing wrong?
|
| regards.
|
| --
| Philippe Strauss
| av. de Beaulieu 25
| 1004 Lausanne
| http://philou.ch
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Microsoft
| Defy all challenges. Microsoft(R) Visual Studio 2008.
| http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBR53Qdv5AbZRALNr/AQLiTwP7BAfByNy4XeuxnPb6byGeKhoa3/eEoS49
Aanpsdf7Ye/IMfcGyILzWWZEwz0ORwuDwz8d8OooVVoze8J7OyhtKNVNMz7YwkaZ
9jjo7mnrh5dC7d4JfMKzSMFy/tFaAEP5mFFxF4ar5bRymjFOaaVYTVFq3d2zkyY6
o/jQJ9ux7A8=
=ZfXo
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
