Re: [Nfdump-discuss] Case of the missing data!

[Brian C. <b.c...@po...>]

On 04/04/2014 11:32, Brian Candler wrote:
>
> Would it be a small patch to nfsen to allow some extra options in the 
> "order by" drop-down?
>
Seems to be as simple as editing details.php and setting:

$IPStatOrder  = array ( 'flows', 'packets', 'bytes', 'ibyte', 'obyte', 
'pps', 'bps', 'bpp' );

:-)
> Now, I notice a problem when grouping by ip/ibyte and ip/obyte: they 
> don't seem to be sorted properly.
>
I *think* this is the problem:

--- bin/nfstat.c.orig    2014-04-04 11:57:35.910580894 +0100
+++ bin/nfstat.c    2014-04-04 11:58:07.014711113 +0100
@@ -421,13 +421,13 @@
      { "opkg",        OUTPACKETS, OUT, DESCENDING, NULL, NULL},
      { "bytes",        INBYTES,     IN,     DESCENDING, NULL, NULL},
      { "ibyte",        INBYTES,    IN,     DESCENDING, NULL, NULL},
-    { "obyte",        INBYTES,    OUT, DESCENDING, NULL, NULL},
+    { "obyte",        OUTBYTES,    OUT, DESCENDING, NULL, NULL},
      { "pps",        INPACKETS,    IN,     DESCENDING, pps_record, 
pps_element},
      { "ipps",        INPACKETS,    IN,     DESCENDING, pps_record, 
pps_element},
-    { "opps",        INPACKETS,    OUT, DESCENDING, pps_record, 
pps_element},
+    { "opps",        OUTPACKETS,    OUT, DESCENDING, pps_record, 
pps_element},
      { "bps",        INBYTES,    IN,     DESCENDING, bps_record, 
bps_element},
      { "ibps",        INBYTES,    IN,     DESCENDING, bps_record, 
bps_element},
-    { "obps",        INBYTES,    OUT, DESCENDING, bps_record, bps_element},
+    { "obps",        OUTBYTES,    OUT, DESCENDING, bps_record, 
bps_element},
      { "bpp",        0,            IN,     DESCENDING, bpp_record, 
bpp_element},
      { "ibpp",        0,            IN,     DESCENDING, bpp_record, 
bpp_element},
      { "obpp",        0,            OUT, DESCENDING, bpp_record, 
bpp_element},

Seems to do the job anyway.
> $ gzip -dc ~/nfcapd.201404031445.gz | nfanon -K <snip> | bin/nfdump -N 
> -s ip/obyte -n 20
>
> rename() error in nfanon.c line 265: Bad address
>
I have no idea about that one.

Cheers,

Brian.