Reading pcap

[carter at qosient.com]

There shouldn't be a difference, so what attributes are missing?

Carter


Carter Bullard
QoSient LLC
150 E. 57th Street Suite 12D
New York, New York 10022
+1 212 588-9133 Phone
+1 212 588-9134 Fax  

-----Original Message-----
From: "CS Lee" <geek00l at gmail.com>
Date: Tue, 10 Apr 2007 19:00:02 
To:Argus <argus-info at lists.andrew.cmu.edu>
Subject: [ARGUS] Reading pcap

Carter,

If i generate argus file from pcap, even if I enable everything in argus.conf and running it with -F argus.conf, apparently some of the flow attributes still missing, so my question is can i retrieve all the possible flow attributes ust by generating argus file from pcap or there will be differences of capturing argus data directly comparing to generating argus data from pcap. 

Thanks.

-- 
Best Regards,

CS Lee<geekooL[at]gmail.com>