Re: [Nfdump-discuss] odd csv output values on ts,te

[Guy, N. <Nea...@nt...>]

Hi Alex,

Data contained in a single nfcapd file is dependant on your nfcapd config and the router delay (flow-cache timeout (for cisco)).
Timezone also plays a factor if the router you are monitoring configured for a different timezone than you are expecting (or even totally incorrect time).

For example we have routers that have a 5min timeout and some that have the default 30mins so I could easily see data from half an hour ago in a file with a timestamp of now.

Cheers,

Neale

From: alex adamos [mailto:aad...@gm...]
Sent: 04 January 2013 17:15
To: nfd...@li...
Subject: [Nfdump-discuss] odd csv output values on ts,te

Hi,
i'm getting a csv output with nfdump (nfdump -r /var/netflow/2012/12/11/18/nfcapd.201212111845 -b -o csv), but in the csv file, i have flows with ts-te= 2012-12-11 17:43:10 for instance. Why do i get this? i have the csv file attached.

thanks

This e-mail (and any attachments) contains information which is intended solely for the attention of the person to whom it has been sent. If you are not the intended recipient, you are not authorised to copy, distribute or use it for any purpose or disclose the contents to any person. If you have received this e-mail in error, please notify us immediately at le...@nt...  and delete this e-mail from your systems.  NTT Europe makes no warranty that this message is error or virus free. Any comments or opinions expressed are those of the originator not of NTT Europe Ltd. unless otherwise expressly stated.  NTT Europe Limited is a company registered in England and Wales with company number 2307625. Registered Address: 3rd Floor, Devon House, 58-60 St. Katharine's Way, London, E1W 1LB, UK.