Re: [Nfdump-discuss] Timestamp issue when using nfcapd with softflowd

[Mark D. N. <mn...@wi...>]

Robin wrote:
> I'm trying to convert pcap data to netflow data using softflowd /
> nfcapd through the following commands:
>  $ nfcapd -p9995 -l ./netflow/
>  $ softflowd -n 127.0.0.1:9995 -r dump.pcap
>   

I had the same issue with nProbe because it would put local timestamps
into the flows and nfcapd (rightly) expects UTC.  Try adding TZ=UTC
prior to starting the command, e.g.:

    env TZ=UTC softflowd -n 127.0.0.1:9995 -r dump.pcap

Regards,
Mark

-- 
Mark D. Nagel, CCIE #3177 <mn...@wi...>
Principal Consultant, Willing Minds LLC (http://www.willingminds.com)
cell: 949-279-5817, desk: 714-495-4001, fax: 949-623-9854

*** Please send support requests to su...@wi...! ***