Fortigate netflow v9 about nfdump HOT 2 CLOSED

Looking into your data, I can not find any problems. The flows are decoded correctly. What you call "messed up" are sampled flows. Some flows include data flow sets, which announce a sampling rate of 22916 - e.g. packet 1155. Bytes and packets are multiplied accordingly. Therefore I do not consider this a bug. If your exporter gets messed up, you may screw down the sampling rate using "-s -1"

from nfdump.

That fixed my problem: "nfcapd -s -1 …".

In case of nfsen (nfsen.conf):
%sources = (
'Device' => { 'port' => '9996', 'col' => '#FF33CC', 'type' => 'netflow', 'optarg' => ' -s -1' },
);

So long,
Aiko

from nfdump.