On p, febr 28, 2014 at 21:34:07 -0300, Giancarlo Razzolini wrote: > Em 28-02-2014 17:16, LEVAI Daniel escreveu: [...] > > 1) Using nfdump seems pretty straightforward, but no matter how I try to > > shape my output, I always get '1970-01-01 01:00:00.000' as "Date first > > seen" time. Also, "Duration" is always 0.000 ... Any ideas why? [...] > First of all, what flowproto do you have set in your pflow interface. I > had the same problem with the first time seem date, and I was using > flowproto 10. There had been some recent (as in 5.5) commits that seems > to correct this issue. I had to switch back to flowproto 5. Try that and > see if it helps.
Thank you Giancarlo, that was the culprit for the time issue! I was using pflowproto 10, indeed. Changing it to 5 immediately solved this problem! Thanks again :) Daniel -- LÉVAI Dániel PGP key ID = 0x83B63A8F Key fingerprint = DBEC C66B A47A DFA2 792D 650C C69B BE4C 83B6 3A8F
