Re: [Nfsen-discuss] nfsen updates its interface after 10 minutes

[Adrian P. <adr...@ro...>]

Ok, thank you kindly. It's a clearer definition now.
I'll try to  reduce the capture time to 2 minutes, so that I can receive 
faster updates.

Thanks,
Adrian Popa

Peter Haag wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Adrian,
>
> - -------- Original Message  --------
> From: Adrian Popa <adr...@ro...>
> To: nfs...@li...
> Subject: [Nfsen-discuss] nfsen updates its interface after 10 minutes
> Date: Tue Aug 01 2006 13:37:35 GMT+0200 (CEST)
>
>   
>> Hello,
>>
>> I've just installed nfdump and nfsen, and things are starting to work. 
>> However, I've noticed the following problem...
>>
>> If nfcapd finishes to write a file at (let's say) 14:05, nfsen will 
>> display that the end time of the profile is 14:00 until the time reaches 
>> 14:10.
>> Between 14:05 and 14:10 I can run nfdump on the aquired file and get the 
>> relevant output from it, but I can't see it in the web interface until 
>> 14:10.
>>
>> So, there's a delay of 5-10 minutes that I can't explain. Is it normal 
>> for the web interface to function this way? Can anyone enlighten me?
>>
>>     
>
> It's important to note, that the time you see in NfSen denotes the timeslot. The timeslot is defined by nfdump, which names the files according the time at the begin of the slot - so the file produces
> at 1400 contains flows from 1400 - 1405. The update cycle processes timeslot '1400' at 1405, so you see a time shift of about 5min for profile life. For other profiles this timeshift is 10min, because
> profiling takes place in slot 1405, and updating the profile in 1410. However, this behaviour will change, and all profiles will have the same timeslots in nfsen-1.3. But the 5min shift is still
> there. In the end it's a question of definition. NfSen names the timeslot after the begin time.
>
> 	- Peter
>
>   
>> Thank you for your help.
>>
>> Adrian Popa
>>
>>
>>
>> -------------------------------------------------------------------------
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to share your
>> opinions on IT & business topics through brief surveys -- and earn cash
>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> Nfsen-discuss mailing list
>> Nfs...@li...
>> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>>
>>     
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag,  Security Engineer,  Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
> SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
> E-mail: pet...@sw... Web: http://www.switch.ch/security
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBRNBN9f5AbZRALNr/AQL1lAP+Ng8/c+7jdMEa+p/UnaaoabR01C7Rkc/D
> PGL4X3Dq5/NlHtk9MS2U/Cgi4gkqdIhhNrhvwcHo51I4RZKRefhwwj7C8qd0i6Vh
> 72VR88jStdbA8jwEiU1gE9HxuCM0CwghBZYH0038Oa5T02WuVoi0VOuO+PCG5tOW
> lPd0UQYBY+o=
> =2jiv
> -----END PGP SIGNATURE-----
>
>   

-- 
Adrian Popa
Junior Engineer NOC-IP,
ROMTELECOM S.A.
Tel: 4003099