[Nfdump-discuss] nfdump pcap *output*?

[Dave P. <pl...@cs...>]

Hi folks,

I have the need, or I'm under the misapprehension that I have the
need, to convert collected v4/v6 flow records into pcap files with
synthetic packets having headers that match the flow records, and
obviously no payload.  The output pcap files would have either the
total packet or byte count matching the flows they represent.

Has anyone patched nfdump or built a tool to do so?

There was a similar option with flow-print (part of flow-tools)
that I once patched to make the byte-count option.

Thanks!
Dave

P.S. Just asking before I write it.

-- 
pl...@cs...  http://net.doit.wisc.edu/~plonka/  Madison, WI