[Nfdump-discuss] Unable to Read .current Files Using nfdump-snapshot-20070312
netflow collecting and processing tools
Brought to you by:
phaag
From: Devon T. <de...@no...> - 2007-05-10 16:36:47
|
All: Using nfdump-snapshot-20070312 I am unable to read the .current files using the -r option. I searched the mailing list and found a thread, <http://thread.gmane.org/gmane.network.nfsen.general/262/focus=5>, that mentions a patch on the 20070110 snapshot, but I was unable to find it on SourceForge or in the tar.gz file. nfdump does read the .DATE files fine. Any ideas? nfdump -V nfdump: Version: snapshot-20070312 $LastChangedDate: 2007-03-13 08:36:17 +0100 (Tue, 13 Mar 2007) $ $Id: nfdump.c 88 2007-03-06 08:49:26Z peter $ nfdump -r nfcapd.current.16539 Date flow start Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows Open file nfcapd.current.16539: bad version: 0 nfdump -r nfcapd.200705101115 -c 10 Date flow start Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows 2007-05-10 11:25:06.782 42.660 TCP x.x.x.x:110 -> y.y.y.y:1546 15 5602 1 2007-05-10 11:25:51.417 1.908 TCP x.x.x.x:110 -> y.y.y.y:63638 2 2840 1 2007-05-10 11:25:46.506 6.819 TCP x.x.x.x:110 -> y.y.y.y:63638 7 1070 1 2007-05-10 11:24:59.734 0.000 TCP x.x.x.x:80 -> y.y.y.y:50913 1 48 1 2007-05-10 11:25:52.514 0.000 TCP x.x.x.x:25 -> y.y.y.y:44257 1 89 1 2007-05-10 11:25:53.721 0.000 TCP x.x.x.x:110 -> y.y.y.y:10812 1 1420 1 2007-05-10 11:24:56.537 52.562 TCP x.x.x.x:110 -> y.y.y.y:10812 2 2834 1 2007-05-10 11:25:49.172 0.000 TCP x.x.x.x:110 -> y.y.y.y:3450 1 40 1 2007-05-10 11:25:14.468 23.266 TCP x.x.x.x:110 -> y.y.y.y:1178 4 5680 1 2007-05-10 11:25:14.468 27.373 TCP x.x.x.x:110 -> y.y.y.y:1178 11 5402 1 Summary: total flows: 10, total bytes: 25025, total packets: 45, avg bps: 3500, avg pps: 0, avg bpp: 556 Time window: 2007-05-10 11:24:53 - 2007-05-10 11:27:53 Total flows processed: 16149, skipped: 0, Bytes read: 839760 Sys: 0.012s flows/second: 1345750.0 Wall: 0.010s flows/second: 1566799.3 -- Devon |