Re: [Nfsen-discuss] nfsen updates its interface after 10 minutes

[Peter H. <ha...@sw...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Adrian,

- -------- Original Message  --------
From: Adrian Popa <adr...@ro...>
To: nfs...@li...
Subject: [Nfsen-discuss] nfsen updates its interface after 10 minutes
Date: Tue Aug 01 2006 13:37:35 GMT+0200 (CEST)

> Hello,
> 
> I've just installed nfdump and nfsen, and things are starting to work. 
> However, I've noticed the following problem...
> 
> If nfcapd finishes to write a file at (let's say) 14:05, nfsen will 
> display that the end time of the profile is 14:00 until the time reaches 
> 14:10.
> Between 14:05 and 14:10 I can run nfdump on the aquired file and get the 
> relevant output from it, but I can't see it in the web interface until 
> 14:10.
> 
> So, there's a delay of 5-10 minutes that I can't explain. Is it normal 
> for the web interface to function this way? Can anyone enlighten me?
> 

It's important to note, that the time you see in NfSen denotes the timeslot. The timeslot is defined by nfdump, which names the files according the time at the begin of the slot - so the file produces
at 1400 contains flows from 1400 - 1405. The update cycle processes timeslot '1400' at 1405, so you see a time shift of about 5min for profile life. For other profiles this timeshift is 10min, because
profiling takes place in slot 1405, and updating the profile in 1410. However, this behaviour will change, and all profiles will have the same timeslots in nfsen-1.3. But the 5min shift is still
there. In the end it's a question of definition. NfSen names the timeslot after the begin time.

	- Peter

> Thank you for your help.
> 
> Adrian Popa
> 
> 
> 
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Nfsen-discuss mailing list
> Nfs...@li...
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
> 

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/security
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iQCVAwUBRNBN9f5AbZRALNr/AQL1lAP+Ng8/c+7jdMEa+p/UnaaoabR01C7Rkc/D
PGL4X3Dq5/NlHtk9MS2U/Cgi4gkqdIhhNrhvwcHo51I4RZKRefhwwj7C8qd0i6Vh
72VR88jStdbA8jwEiU1gE9HxuCM0CwghBZYH0038Oa5T02WuVoi0VOuO+PCG5tOW
lPd0UQYBY+o=
=2jiv
-----END PGP SIGNATURE-----