Recent changes to support-requests

1M = 1000000 or 1M = 1024*1024

Anonymous — Mon, 15 Apr 2013 09:56:18 -0000

Hi!
I have a question about nfdump. I execute this command:
nfdump -r /var/netflow/nfcapd.201304101213 -o fmt:%sa%da%byt -q
After that i've got this data:

91.214.242.128 91.149.149.207 196
213.176.239.12 91.214.242.84 3.1 M
78.31.73.172 91.214.240.173 3789
91.214.242.247 91.224.223.96 137182
95.182.104.86 91.214.242.247 1.5 M
The question is, how can i translate this digits:
1M = 1000000 or 1M = 1024*1024 ?

lAwUXL gxrhzvxteyvh,

Anonymous — Sun, 14 Apr 2013 01:16:59 -0000

lAwUXL <a href="http://gxrhzvxteyvh.com/">gxrhzvxteyvh</a>, [url=http://cnmlefzuxwka.com/]cnmlefzuxwka[/url], [link=http://xebkmrcqlvii.com/]xebkmrcqlvii[/link], http://noibdymskzoz.com/

v1.3.6p1 compilation problem

Nick Apple — Sat, 16 Apr 2011 15:17:00 -0000

I have successfully compiled/installed nfdump with ./configure, make, make install (on Centos 5.6) but it doesn't work when (I need it for nfsen):

./configure --enable-nfprofile

It complains:

checking for rrd_update in -lrrd... no
configure: error: Can not link librrd. Please specify --with-rrdpath=.. configure failed!

Then I do:

./configure --enable-nfprofile --with-rrdpath=/usr/lib64/librrd.so.4

and it fails:

configure: error: in `/root/nfdump-1.6.3p1':
configure: error: C preprocessor "/lib/cpp" fails sanity check

What can I do?

I attach config.log (gzipped).

Regards,
Nick

new templates

Luca Di Stefano — Wed, 23 Feb 2011 15:12:13 -0000

Hello,
I'm looking for add new netflow templates in nfdump. NProbe sends new templates about latencies and http infos and I will try to collect them with nscaptured and visualize with nfsen.

I added in nfx.c
{ EX_LATENCY, 24, 15, 0, "latency"},
(are 6 fields of 32 bit)

then in nffile.h added the new structure:
#define EX_LATENCY 26
typedef struct tpl_ext_26_s {
uint32_t client_nw_delay_usec;
uint32_t client_nw_delay_sec;
uint32_t server_nw_delay_usec;
uint32_t server_nw_delay_sec;
uint32_t appl_latency_usec;
uint32_t appl_latency_sec;
uint8_t data[4]; // points to further data
} tpl_ext_26_t;
and
added the fields in the master_record

The problem is that only the first field is filled.
They are other steps or hints that you can give me?

If the integration succeds, can I provide you a patch to integrate in the mainstream?

thanks!

Luca

P.S. I will try to document how implement a new template.

UDP Extended output shows "Flags"

Anonymous — Mon, 12 Apr 2010 15:11:59 -0000

Hello,

In some cases dumping flowdata shows "tcpflags" in extended format.
2010-04-12 16:53:44.408 0.000 UDP 192.168.0.1 -> 192.168.0.1.:53 .A.... 0 1 73 0 0 73 1

does this output have any special means? udp itself obviously does not have any "flags".

How nfdump-1.5.7 will handle 4 byte AS numbers.

Anonymous — Thu, 11 Feb 2010 09:53:33 -0000

nfdump-1.6 very well support the 4 byte AS numbers but does the old nfdump version 1.5.7 would crash if it see 4 byte AS numbers (new 4 byte AS dot notation) in the netflow?
I dont have v9 netflow captured to test this. Please respond.