search

phaag / nfdump

Netflow processing tools
Other
791 stars 206 forks source link

Aggregation - duplicate entries for router #536

Closed piorek94 closed 6 months ago

piorek94 commented 6 months ago

Problem:

Duplicate entries in aggregation mode for router (-A router).

Environment

nfdump version: v1.7.4-7b701c9

Description:

Aggregation mode for router reports duplicate entries for ipv4 and ipv6 flows. In file there are 460 ipv6 records (first entry) and 21652 ipv4 records (second entry):

nfdump175 -r nfcapd.202405221501 -A router
Date first seen         Duration                 Router IP   Packets    Bytes      bps    Bpp Flows
2023-08-14 12:15:25.952     00:07:43.616      192.168.56.1    792017  882.6 M   15.2 M   1114   460
2023-08-13 20:23:09.824     15:59:59.744      192.168.56.1    19.3 M   14.2 G    2.0 M    736 21652
Summary: total flows: 22112, total bytes: 15.1 G, total packets: 20.1 M, avg bps: 2.1 M, avg pps: 348, avg bpp: 751
Time window: 2023-08-13 20:23:09 - 2023-08-14 12:23:09
Total flows processed: 22112, passed: 22112, Blocks skipped: 0, Bytes read: 4596784
Sys: 0.0120s User: 0.0000s Wall: 0.0115s flows/second: 1923799.5 Runtime: 0.0132s

Expected behavior

Single entry for this same router ip.

phaag commented 6 months ago

Thanks for the report. The master fixes this and other v4/v6 aggregation bugs.