On Thu, Apr 17, 2008 at 2:03 PM, Peter Haag <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> - --On April 17, 2008 12:51:02 +0300 Adrian Popa <[EMAIL PROTECTED]>
> wrote:
>
> | Sorry, then it seems I read it somewhere else...
> |
> | The exporter's address would be useful when running a top on different
> | sources simultaneously.
> |
> | The question would be: what is more important - to display the actual IP
> of
> | the exporter or to display the name of the configured source that
> exports
> | that information.
>
> I'm not aware of any exporter using the v9 interface name tag, which
> allows to display
> the configured source interface. To be realistic, the IP address may be
> the only hint.
>
Well, the interface name is not exported in the flows and this is not what I
was asking. Sorry for misleading you, but by 'the source that exports the
information' I meant the source IP that exports the information, not the
source interface...
>
> |
> | If it were a vote, I would vote the second (just display the name of the
> | source); saving exporter IPs in the nfcapd* files would be a waste of
> space
> | if each exporter represents one source.
>
> Well - the waste of space id not that of a problem, as each exporter is
> fully described
> once only, which references to the record. The format of nfcapd.* will be
> extended anyway
> for the additional v9 tags.
Good thinking!
>
>
> - Peter
>
> |
> | This would be easier to implement and you wouldn't have to change
> anything
> | in the format of the nfcapd* files.
> |
> | Cheers,
> | Adrian
> |
> |
> | On Thu, Apr 17, 2008 at 10:34 AM, Peter Haag <[EMAIL PROTECTED]>
> wrote:
> |
> | > -----BEGIN PGP SIGNED MESSAGE-----
> | > Hash: SHA1
> | >
> | > Hi Adrian,
> | >
> | > - --On April 17, 2008 8:48:43 +0300 Adrian Popa <
> [EMAIL PROTECTED]>
> | > wrote:
> | >
> | > | Hello everybody,
> | > |
> | > | I seem to remember that the flows saved by nfdump also store the
> | > exporter's
> | > | IP address. Is this true?
> | >
> | > No - up to nfdump-1.5.7 there is no exporter's information in the data
> | > files.
> | > nfdump-1.6, which I'm currently working on, may contain these infos -
> but
> | > not
> | > yet finally decided.
> | >
> | > - Peter
> | >
> | >
> | > | Also, can I specify an output filter to display this address? if
> yes,
> | > what
> | > | is the syntax (man nfdump didn't reveal anything about this)...
> | > |
> | > | Thank you.
> | >
> | >
> | >
> | > - --
> | > _______ SWITCH - The Swiss Education and Research Network ______
> | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > -----BEGIN PGP SIGNATURE-----
> | > Version: GnuPG v1.4.3 (Darwin)
> | >
> | > iQCVAwUBSAb9cv5AbZRALNr/AQJygwP/c9rtSKH1V7cGWXs8EWSp3R7095jArbXp
> | > oE5bkWcZgTl3g6q9Nn3x6FDLm+N+qipR8vI7Cutx7+TsaaerGQepkvGawLCpKkHh
> | > 1kF2Q6mmAgxd1VTwWH0D7BNwfhMkFVdcA4bEjGNOONRPzxGsK04ESZZGEa+XMEbz
> | > +IHszXmd0DI=
> | > =BhBH
> | > -----END PGP SIGNATURE-----
> | >
> | >
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBSAculP5AbZRALNr/AQLLeQP/aUKik/ZSpuhArsW+c5ZuWFYGtvAbApIO
> C001wWlyxLVccCRhOzQjnXAPJEq0TzrQCTgam0ziJceaiIw65TBbnkGcr6oR7h8Z
> 1dJ5HjxdzKkSvHC6wyOilfltJfm/vJs0UFsL7hzrz0XI8HFRyh0HW39tdY7FTVL8
> McyivF4+Ci0=
> =z4f9
> -----END PGP SIGNATURE-----
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
