in nf_common.c:
{ "%idmc", 0, " In dst MAC Addr", String_OutSrcMac }, // Input Dst Mac Addr
{ "%osmc", 0, " Out src MAC Addr", String_InDstMac }, // Output Src Mac Addr
(note %idmc is connected to output source MAC and %osmc to input destionation MAC)
Sample output from nfdump:
# nfdump -r nfcapd.201208271040 -o raw
Flow Record:
Flags = 0x06 Unsampled
size = 84
first = 1346031544 [2012-08-27 03:39:04]
last = 1346031551 [2012-08-27 03:39:11]
msec_first = 988
msec_last = 992
src addr = 0.0.0.0
dst addr = 0.0.0.0
src port = 0
dst port = 0
fwd status = 0
tcp flags = 0x00 ......
proto = 0
(src)tos = 0
(in)packets = 4
(in)bytes = 369
in src mac = 0c:a4:02:bc:86:b6
out dst mac = 00:00:00:00:00:00
in dst mac = 58:8d:09:eb:34:c0
out src mac = 00:00:00:00:00:00
Raw output is correctly displayed (as is sent by the switch).
# nfdump -r nfcapd.201208271040 -o "fmt:%ismc - %idmc - %osmc - %odmc"
In src MAC Addr In dst MAC Addr Out src MAC Addr Out dst MAC Addr
0c:a4:02:bc:86:b6 - 00:00:00:00:00:00 - 58:8d:09:eb:34:c0 - 00:00:00:00:00:00
In formatted output input destination MAC address is displayed under output source MAC column.
# nfdump -V
nfdump: Version: 1.6.6 $Date: 2012-03-11 11:57:45 +0100 (Sun, 11 Mar 2012) $
Thanks! - Fixed in 1.6.8