You should be able to use "router ip", according to the manual:

       Router IP
           router ip <ipaddr>
           Filter the flows according the IP address of the exporting
router.

Cheers!

On Thu, Sep 6, 2012 at 5:23 PM, Matthias Cramer <matthias.cra...@iway.ch>wrote:

> Hi All
>
> Is it possible to filter by flow source ?
> For example I want to get all traffic from one interface 1 on router A and
> all traffic on interface 5 on router B.
>
> Here is what I currently have:
>
> nfdump -M "/data/nfsen/profiles-data/live/rta:rtb/*/*/*/" \
> -R nfcapd.${FROM}:nfcapd.${TO} \
> -s record/bytes -A srcip -n ${TOPN} -o "fmt:%sa %byt" 'in if 46 or in if
> 10'
>
> Problem is, that these two interface ids are also used on the other router
> ...
>
> Regards
>
>   Matthias
>
> --
> Matthias Cramer / mc322-ripe   Senior Network & Security Engineer
> iway AG                        Phone +41 43 500 1111
> Badenerstrasse 569             Fax   +41 44 271 3535
> CH-8048 Zürich                 http://www.iway.ch/
> GnuPG 1024D/2D208250 = DBC6 65B6 7083 1029 781E  3959 B62F DF1C 2D20 8250
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Nfsen-discuss mailing list
> Nfsen-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
>
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss

Reply via email to