Jacob Willetts - 2015-08-25

I don't know if this is the right place to ask this, but here goes.

I have used Yaf to export IPFIX (with the --mac switch set), collected them with rwflowpack and used rwcut to print the contents of the files. Why is there no option to print MAC addresses? It says in the Yaf docs that MAC's are supported, but I haven't confirmed this. I have tried nfcapd + nfdump to collect and view the files but the MAC addresses are all zero. I have also tried softflowd but I get the same results. Are there no open-source probes which properly implement IPFIX?