-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Tore,
On 7/6/10 11:43, Tore Anderson wrote:
> Hi Peter,
>
> * Peter Haag
>
>> There is no direct switch for applying a sampling rate. However, the
>> quickest way is a local hack of ft2nfdump.c for the sake of
>> converting:
>
> Thank you, looks much better now. However I ran into a couple of new
> problems. First, the rate values when selecting "single timeslot" on
> the details tab are too high. I'm suspect that what's going on here is
> that Nfsen assumes that the converted files contain five minutes worth
> of data, while they really contain fifteen minutes (since that's how
> often the flow-tools files were rotated, and I found no way of splitting
> them while converting). So all the rates are exaggerated by a factor of
> three.
Well - I'm afraid you have to properly split the flow-tools file beforehand.
>
> Second, the imported data doesn't show up in the graphs at all. I tried
> "nfsen -r live" and also moving the RRD file out of the way (hoping it'd
> get recreated automatically), but neither helped.
Not that easy. What you can try:
o convert from flow-tools.
o Put NfSen into Sim mode, by setting the proper %sim settings. See
nfsen-dist.conf
o run the simulation for your files.
o stop the simulator - do *not* reset!
o Disable sim mode.
o Restart NfSen.
It's a rather ugly and manual hack, but the only way at the moment.
- Peter
>
> Any suggestions?
>
> Best regards,
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [email protected] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBTDV0LP5AbZRALNr/AQI9LwQAqOv/fXzt7P2BZB6lCx2m/nC1ztwcStgw
qNGG4WGyOL2YIYhDM0pOAs4U2eagPGvzVzjmvm1Ek2f2lXMwInfwcXUGX6DOncPs
0tYKL3Dkb9K3ocgiz6t9OCLBzGscrl7whbuD2qioMnBZkYZeZjv7oxN+U9SlF+Us
l+EcXBHeBqw=
=z+SI
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
