Closed pstimmons closed 4 years ago
[root@nuc ~]# cat /etc/centos-release CentOS Linux release 8.1.1911 (Core) [root@nuc ~]# rpm -qi nfdump Name : nfdump Version : 1.6.19 Release : 1.el8 Architecture: x86_64 Install Date: Wed 18 Mar 2020 05:02:53 AM EDT Group : Unspecified Size : 813446 License : BSD and GPLv2+ Signature : RSA/SHA256, Fri 28 Feb 2020 07:25:02 PM EST, Key ID 21ea45ab2f86d6a1 Source RPM : nfdump-1.6.19-1.el8.src.rpm Build Date : Fri 28 Feb 2020 07:14:36 PM EST Build Host : buildvm-19.phx2.fedoraproject.org Relocations : (not relocatable) Packager : Fedora Project Vendor : Fedora Project URL : https://github.com/phaag/nfdump Bug URL : https://bugz.fedoraproject.org/nfdump Summary : NetFlow collecting and processing tools Description : Nfdump is a set of tools to collect and process NetFlow data. It's fast and has a powerful filter pcap like syntax. It supports NetFlow versions v1, v5, v7, v9 and IPFIX as well as a limited set of sflow. It includes support for CISCO ASA (NSEL) and CISCO NAT (NEL) devices which export event logging records as v9 flows. Nfdump is fully IPv6 compatible. [root@nuc ~]#
Thanks! - you are right!
Fixed in current master
I reviewed the code today and there seems to be the same defective code in PrintSortedFlowcache() in nfstat.c
if ( GuessFlowDirection &&
( flow_record->prot == IPPROTO_TCP || flow_record->prot == IPPROTO_UDP) &&
( flow_record->srcport < 1024 ) && ( flow_record->dstport >= 1024 ) &&
( flow_record->srcport < 32768 ) && ( flow_record->dstport >= 32768 ) &&
( flow_record->srcport < 49152 ) && ( flow_record->dstport >= 49152 ))
SwapFlow(flow_record);
I guess it should be modified too.
Sure! you are right!
Fixed in 994cc18
While analyzing tcp/22 inbound traffic I noticed that the -B option doesn't always swap those flows. Here is an example:
`
`I think the following code is responsible for not swapping some of the flows:
`
`Unless there is some significance with port 32768 (2^15) and 49152 that I'm not aware of ?