Hi,
We are using nfdump version 1.68
When we query a nfdump file with order ip/bytes, it shows the top IP are
using more than 3.8 PPS, but when we apply a pps filter to it, it will not
show up at all
nfdump -r nfcapd.201303241126 -n 3 -s ip/bytes
Date first seen Duration Proto IP Addr Flows(%)
Packets(%) Bytes(%) pps bps bpp
2013-03-24 11:26:00.010 44.540 any 50.117.123.211 82475(33.3)
168.9 M(33.3) 10.5 G( 5.0) 3.8 M 1.9 G 62
2013-03-24 11:26:00.059 59.902 any 69.46.65.8 2368( 1.0)
4.8 M( 1.0) 4.8 G( 2.3) 80959 644.1 M 994
2013-03-24 11:26:00.033 59.947 any 50.117.24.90 1853( 0.7)
3.8 M( 0.7) 3.6 G( 1.7) 63304 476.9 M 941
===============================================
nfdump -r nfcapd.201303241126 -n 3 -s ip/bytes 'pps > 3m'
Date first seen Duration Proto IP Addr Flows(%)
Packets(%) Bytes(%) pps bps bpp
Summary: total flows: 0, total bytes: 0, total packets: 0, avg bps: 0, avg
pps: 0, avg bpp: 0
=============================================
And even if we apply a pps>1k , it still not show up
nfdump -r nfcapd.201303241126 -n 3 -s ip/bytes 'pps > 1k'
Top 3 IP Addr ordered by bytes:
Date first seen Duration Proto IP Addr Flows(%)
Packets(%) Bytes(%) pps bps bpp
=============================================
When we apply the pps < 1k, everything shows up again, doesn's seem like
the filter works for me.
Any help with with highly appriciate
--
Thanks,
Di
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
