Sorry, then it seems I read it somewhere else...
The exporter's address would be useful when running a top on different
sources simultaneously.
The question would be: what is more important - to display the actual IP of
the exporter or to display the name of the configured source that exports
that information.
If it were a vote, I would vote the second (just display the name of the
source); saving exporter IPs in the nfcapd* files would be a waste of space
if each exporter represents one source.
This would be easier to implement and you wouldn't have to change anything
in the format of the nfcapd* files.
Cheers,
Adrian
On Thu, Apr 17, 2008 at 10:34 AM, Peter Haag <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Adrian,
>
> - --On April 17, 2008 8:48:43 +0300 Adrian Popa <[EMAIL PROTECTED]>
> wrote:
>
> | Hello everybody,
> |
> | I seem to remember that the flows saved by nfdump also store the
> exporter's
> | IP address. Is this true?
>
> No - up to nfdump-1.5.7 there is no exporter's information in the data
> files.
> nfdump-1.6, which I'm currently working on, may contain these infos - but
> not
> yet finally decided.
>
> - Peter
>
>
> | Also, can I specify an output filter to display this address? if yes,
> what
> | is the syntax (man nfdump didn't reveal anything about this)...
> |
> | Thank you.
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBSAb9cv5AbZRALNr/AQJygwP/c9rtSKH1V7cGWXs8EWSp3R7095jArbXp
> oE5bkWcZgTl3g6q9Nn3x6FDLm+N+qipR8vI7Cutx7+TsaaerGQepkvGawLCpKkHh
> 1kF2Q6mmAgxd1VTwWH0D7BNwfhMkFVdcA4bEjGNOONRPzxGsK04ESZZGEa+XMEbz
> +IHszXmd0DI=
> =BhBH
> -----END PGP SIGNATURE-----
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
