This seems to be related to your exporter. The timstamps are decoded
accordingly, but the values found are way out and
look invalid.
- Peter
On 25.04.14 12:03, Varun Sharma wrote:
> Hi ,
>
> I am using nfcapd for collecting ipfix flows.I am seeing issue with date
> and time field . I am using 152 and 153 tag for timestamp field.
>
> data sample ....
>
> $ nfdump -r nfcapd.201404251111
>
>
> Date first seen Duration Proto Src IP Addr:Port Dst
> IP Addr:Port Packets Bytes Flows
> *1985-12-04 07:56:13.632* 17179869.184 TCP 10.208.14.238:22 ->
> 10.208.14.234:49202 520 2 1
>
> *1986-01-23 00:59:00.928* 897648164.864 TCP 10.208.14.234:49202 ->
> 10.208.14.238:22 80 2 1
>
> *2057-12-03 01:31:13.216* 68719476.736 UDP 10.208.14.106:57066 ->
> 239.255.255.250:1900 912 6 1
>
> *2078-06-22 07:32:14.912* 429496729.600 UDP 10.208.14.115:49940 ->
> 224.0.0.252:5355 96 2 1
>
> *2061-08-06 05:46:30.208* 21474836.480 UDP 10.208.14.78:37603 ->
> 10.208.15.255:111 256 2 1
>
> *2008-03-30 19:33:30.176* 429496729.600 UDP 10.208.14.50:54528 ->
> 224.0.0.252:5355 110 2 1
>
>
> *:::*
> Summary: total flows: 49, total bytes: 121, total packets: 31134, avg bps:
> 0, avg pps: 0, avg bpp: 0
> Time window: *2042-12-13 22:24:30 - 2076-11-02* 18:58:47
> Total flows processed: 49, Blocks skipped: 0, Bytes read: 2648
> Sys: 0.002s flows/second: 16338.8 Wall: 0.001s flows/second: 37867.1
>
>
> I attached tcpdump pcap file also. Pls find attachment.
>
> can anybody know why it's happening ?
>
> Thanks
>
>
> Regards
> varun
>
>
>
> ------------------------------------------------------------------------------
> Start Your Social Network Today - Download eXo Platform
> Build your Enterprise Intranet with eXo Platform Software
> Java Based Open Source Intranet - Social, Extensible, Cloud Ready
> Get Started Now And Turn Your Intranet Into A Collaboration Platform
> http://p.sf.net/sfu/ExoPlatform
>
>
>
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
