Re: [Nfdump-discuss] ASA and post-NAT addresses

2013-11-21 Thread Peter Haag
Thanks Brian - it's fixed in nfdump-1.6.11 which will be released most likely tomorrow. It will also support ASA 9.1 data. - Peter On 21/11/13 10:55 AM, Brian Candler wrote: > On 21/11/2013 09:23, Peter Haag wrote: >> Hi Brian, >> It looks to me, as you did not enable nsel at compile tim

Re: [Nfdump-discuss] ASA and post-NAT addresses

2013-11-21 Thread Brian Candler
On 21/11/2013 09:23, Peter Haag wrote: Hi Brian, It looks to me, as you did not enable nsel at compile time. You need to run at least ./configure --enable-nsel and make, make install Ah yes, you're quite right. I had only done ./configure --enable-nfprofile --enable-nftrack and didn't realise yo

Re: [Nfdump-discuss] ASA and post-NAT addresses

2013-11-21 Thread Peter Haag
Hi Brian, It looks to me, as you did not enable nsel at compile time. You need to run at least ./configure --enable-nsel and make, make install This enables a couple of things: - Let's you make use of -Tnsel for the collector. Of course you can use -Tall or +27, +28 at any time though. - Enables

[Nfdump-discuss] ASA and post-NAT addresses

2013-11-19 Thread Brian Candler
Capturing Netflow/IPFIX records from Cisco ASA running 8.4.7 firmware, to nfdump 1.6.10p1. When I look at outbound flows, I see the source (private) IP and the destination (public IP). But when looking at inbound flows, the destination address is the public IP, not the private IP to which it is