Closed tvdhout closed 2 years ago
Hi,
UDP flows do not have TCP flags set. It is the result of the way of recording and storing information about flows by nfdump - it this case you can assume that it artifact.
nfdump only stores what the exporter sends. If the exporter does not properly clean the flags before sending the flows, you get this result. So it's not a question of nfdump, but the exporter
I am analyzing some SFLOW capture files with nfdump and in some UDP flows it says some TCP flags are on. Anonymized example:
How do I interpret this? Is it in the data? There are more rows like this. I can't make sense of a UDP flow with TCP flags. Any help is appreciated.