search

ntop / n2disk

Open source components and extensions for n2disk
498 stars 11 forks source link

n2disk should index pcap file with l7proto without enable --zmq-export-flows #25

Closed annp1987 closed 4 years ago

annp1987 commented 4 years ago

Currently, we're intending to use n2disk for saving packet and use npcapextract for extracting a pcap file with l7proto, something looks like: npcapextract -a 9.pcap -i 9.pcap.idx -o test111.pcap -f "l7proto 159". But it won't work if we don't enable --zmq-export-flows. However, enabling export flows via zmq is seem redundant in our case. So it would be great if n2disk support index pcap file with l7proto as default.

cardigliano commented 4 years ago

@annp1987 this will be available with the next dev build later today, option -E 2