Bad magic 0x10CF about nfdump HOT 4 CLOSED

@thezoggy - thanks for your explanation! - I need to add, that theft2nfdump(1) is unfortunately outdated.
Sice 1.7.x. nfdump no longer reads from stdin. So the correct command line is:

% ft2nfdump -r  ft-v05.2024-03-13.040001-0400 -z=lz4 -w ft-v05.2024-03-13.040001-0400.nf
% nfdump -r ft-v05.2024-03-13.040001-0400.nf

I need to correct the man page!

from nfdump.

nfdump is to read files stored in the nfcapd format... not read raw netflow files.
nfcapd = is the netflow collector which stores the flow records into files for nfdump..

which would explain why they arent in the correct 'format' hence your file doesnt have the expected magic bit set in it:
https://github.com/phaag/nfdump/blob/master/src/libnffile/nffileV2.h#L46

there are various tools to get data into nfdump formatted files if your not just sending the netflow to the box.

readpcap = load data via pcap
nfpcapd = create netflow data from interface or pcap data
ft2nfdump = converts flow-tools data into nfdump format.
-- from what you said this might be what you are looking for?

also its generally good practice when opening a github issue for an app is to share what version of the software / and info about your env (what os/how you running it).

taken from source forge page:

Converting flow-tools netflow data:

The flow-tools converter reads flow-tools data either from stdin, or from a given file ( -r ). It converts the data into nfdump format and writes nfdump records to stdout.
To concert a file: ft2nfdump -r <flow-tools-file> | nfdump -w <nfdump-file>.
Of course you can supply any other nfdump command line switches to directly process flow-tools data with nfdump.

from nfdump.

Thank you both for your help! It works after I configure with the '--enable-ftconv' option and running the suggested ft2nfdump commands.

from nfdump.

Closing the issue now

from nfdump.