I has the same problem to separate incomin and outgoing traffic. Doing like Adrian says i remember that traffic can't be seen in the live profile.
To separate incoming and outgoing and see both in live profile i do the following: i define to sources: IN on port 555 and OUT on port 666 and configured them in the live profile. then i receive netflows traffic on another port, lets say 3333, with a command like this: nfcapd -w -D -p 3333 -u www -g www -x'myScript %f' then my script "myScript" take the name of captured file on %f and execute some like this: #!/bin/bash nfreplay -r $1 -H localhost -p 555 'inif 2' nfreplay -r $1 -H localhost -p 666 'inif 3' anyway, now i have cisco layer3 switch that not have netflow support and i have to make this filtering in a span port with fprobe to generate netflows I hope this helps. I search my original script but i don't found it. Nicolas Macia Quoting Adrian Popa <[EMAIL PROTECTED]>: > The way I differentiate incoming and outgoing flows is by making a filter in > which I specify the input interface or output interface. Something like > 'inif 12' or 'outif 22'. The numbers are snmp interface indexes (you can see > them on cisco with 'show snmp mib ifmib ifindex' command). You could create > profiles with these filters and the graphs will show you what you want. > > Cheers, > Adrian Popa > > On 4/11/07, Mohacsi Janos <[EMAIL PROTECTED]> wrote: >> >> Hi Kevin, >> Have a look at my answer earlier on the mailing list: >> >> http://sourceforge.net/mailarchive/message.php?msg_name=20070321114007.E78170%40mignon.ki.iif.hu >> >> >> Janos Mohacsi >> Network Engineer, Research Associate, Head of Network Planning and >> Projects >> NIIF/HUNGARNET, HUNGARY >> Key 70EF9882: DEC2 C685 1ED4 C95A 145F 4300 6F64 7B00 70EF 9882 >> >> On Wed, 11 Apr 2007, Kevin Chege wrote: >> >>> Hi guys, I have NFSen working fine with flows from 2 Cisco routers. >> However, >>> I would like to differentiate incoming traffic from outgoing traffic in >> some >>> of the graphs I create and also on Portscanner. How can I achieve this? >>> Thanks. >>> >>> >> >> ------------------------------------------------------------------------- >> Take Surveys. Earn Cash. Influence the Future of IT >> Join SourceForge.net's Techsay panel and you'll get the chance to share >> your >> opinions on IT & business topics through brief surveys-and earn cash >> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV >> _______________________________________________ >> Nfsen-discuss mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss >> ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
