Your assumption is correct. Replacing the files is exactly what we would
like to do and we do not want to do it in real time either.
We can run our "AS field replacement" script for files that are a few hrs
old. I said we "can" but I should have said we "must" run this not on real
time because the program that figures out the AS number can not run that
fast.
The problem with the nfcapd files is that we do not know how to reconstruct
the file to a binary form, after dumping it and replacing AS 0 with the
proper value in it.
Thank you,
Alban
On Wed, May 7, 2008 at 5:51 PM, Till Dörges <[EMAIL PROTECTED]> wrote:
> On 03.05.2008 04:08, Alban Dani wrote:
>
> We have put a process in place that gets the nfdump binaries, dumps them
>> through 'nfdump -r "file name" -o raw' and through another script replaces
>> the AS 0 (has been brought up in previous conversations that we do not have
>> a full routing table) with the proper AS number based on the prefix.
>> We have double checked and the results are very reliable.
>
>
>>
>> However we have a problem.
>> How to we get the dump-ed (raw if you will) file back to the binary form
>> so that nfsen can reuse it?
>>
>
> Do I understand correctly that you want to want to replace the very data
> files? I.e. take the time slice nfcapd.200801171840, modify it and put the
> modified version in it's place?
> Then you might be able to just replace the nfcapd.* files "behind NfSen's
> back". My guess is that it'll work most of the time but that there's a slim
> chance of sabotaging your NfSen installation when it tries expiry and the
> likes.
>
> If you want to do it properly you probably have to hook your modification
> program to where the profiles are written. For the live profile the hash
> %CollectorMap in nfsen/libexec/NfSenRC.pm could be a good starting point.
> For the remaining profiles nfsen/bin/nfsend (function Periodic()) could be
> of interest.
>
> I'm writing "could" because I haven't tried it myself. And as far as I
> understand the code no configurable way has been provided to achieve what
> you want.
>
> HTH -- Till
> --
> Dipl.-Inform. Till Dörges [EMAIL PROTECTED]
> Senior Researcher Phone: +49 (0)700 / PRESECURE
>
> PRESECURE Consulting GmbH, Münster AG Münster, HRB 6581
> Geschäftsführer/Managing Director Dr. Klaus-Peter Kossakowski
>
> CarmentiS - Early Warning Expertise
> http://www.carmentis.org
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
