On Feb 22, "Chanjing Han" wrote: > hi: > I use the flow-export and can't export the "DOCTETS" field.why? > in the following two commands,If I add the DOCTETS field ,flow-tools will > show the error information. > [EMAIL PROTECTED] bin]# ./flow-cat > /var/netflow/ft/working/saved/ft-v05.2005-02-21.080500+0800 |./flow-export > -f2 -mSRCADDR,DSTADDR>flows.ascii > ./flow-export: Exported 224815 records > [EMAIL PROTECTED] bin]# ./flow-cat > /var/netflow/ft/working/saved/ft-v05.2005-02-21.080500+0800 |./flow-export > -f2 -mSRCADDR,DSTADDR,DOCTETS>flows.ascii > flow-export: Out of order field: DOCTETS > flow-export: ftxfield_parse(): failed > > hope you answer and thank you !
It wants you to list the fields in the order that they appear in a raw "flow-export -f2" This is the order when you do flow-export -f 2: #:unix_secs,unix_nsecs,sysuptime,exaddr,dpkts,doctets,first,last,engine_type,eng ine_id,srcaddr,dstaddr,nexthop,input,output,srcport,dstport,prot,tos,tcp_flags,s rc_mask,dst_mask,src_as,dst_as doctets is before srcaddr and dstaddr This works: flow-export -f 2 -mDOCTETS,SRCADDR,DSTADDR Mike _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
