64 bit counters for IN_BYTES and OUT_BYTES about nfdump HOT 5 CLOSED

nfdump handles 8bytes (64bit) counters already for years. INternally nfdump uses only 64bit counters.
If the counters are wrong, this mus be something different. Please send me a pcap captured at the collector side to check.

from nfdump.

Hi,

Here you have a pcap file and the debug output from my perl script parsing the same pcap file.

If you want to make it easy for you to see the difference when 64 bit fields for IN_Bytes and OUT_bytes is used use "dst host 130.240.19.2" and if source starts with 130.240.x.x then it is processed by Fortigate. Else it processed by Cisco with normal 32bit counters.

130.240.19.2 is one of our DNS servers

Från: Peter Haag [email protected]
Skickat: den 6 maj 2016 14:18
Till: phaag/nfdump
Kopia: Thomas Nilsson; Author
Ämne: {Disarmed} Re: [phaag/nfdump] 64 bit counters for IN_BYTES and OUT_BYTES (#22)

nfdump handles 8bytes (64bit) counters already for years. INternally nfdump uses only 64bit counters.
If the counters are wrong, this mus be something different. Please send me a pcap captured at the collector side to check.

You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHubhttps://github.com//issues/22#issuecomment-217425141

from nfdump.

PecapAndDebug.zip

from nfdump.

Hi,

Are you looking into this issue even when you closed it before I had the time to reply, or do I need to open a new ticket?

from nfdump.

Could be that Fortigate don’t send TCP flags in their export. If this field is missing how do your code cope with it?

from nfdump.