search

phaag / nfdump

Netflow processing tools
Other
777 stars 203 forks source link

Request: Add TTL field #543

Closed caikpigosso closed 2 months ago

caikpigosso commented 3 months ago

Hello, I would like to know if it's possible to add the TTL field to be displayed in nfdump. It would be very useful for monitoring altered sources with spoofing.

phaag commented 3 months ago

Do you have an exporter, which sends this information? Which element IDs are used? There are multiple option: 192, 52, 53

phaag commented 2 months ago

@caikpigosso - any comments on the question above?

caikpigosso commented 2 months ago

Hello,

I sent the sample to your email, with this wireshark screenshot to select the field

Captura de Tela 2024-07-08 às 09 14 12
phaag commented 2 months ago

give it a try with latest commit. Implements filtering e.g. ttl > 64 as well as aggregation and statistics -s ttl

gabrielmocan commented 2 months ago

@phaag mind adding this extension to go-nfdump as well?

caikpigosso commented 2 months ago

@phaag It worked, thank you very much.

image
phaag commented 2 months ago

@gabrielmocan see https://github.com/phaag/go-nfdump/issues/15 completed.