[flow-tools] flow-report ip-destination-address-source-count broken?
Russell Dwarshuis
rjd@merit.edu
Thu, 9 Jan 2003 11:50:51 -0500 (EST)
I'm not getting anything useful out of ip-destination-address-source-count
from flow-report. With similar configurations (in the same config file) I
get valid reports for all other reports I've tried, including
ip-source-address-destination-count and ip-destination-address
I'm using version 0.63 with the patch at
http://www.pairlist.net/pipermail/flow-tools/2002-December/000928.html
When fed previously tagged flows,
flow-cat ft-v1005.2003-01-08.* | flow-report -s /tmp/stat.conf -S report0
gives:
# recn: ip-destination-address,flows,octets,packets,duration
0.0.0.31,939407,895335817,2628906,7736751156
/tmp/stat.conf:
include-filter /tmp/filter.conf
stat-report SUBNET-BB_ip-destination-address-source-count
filter SUBNET-BB_dst
type ip-destination-address-source-count
output
path
/private2/raw_reports/%Y/%m/%d/SUBNET-BB_ip-destination-address-source-count
stat-definition report0
report SUBNET-BB_ip-destination-address-source-count
/tmp/filter.conf:
filter-primitive SUBNET-BB
type tag
permit 0x100F
filter-definition SUBNET-BB_src
match src-tag SUBNET-BB
filter-definition SUBNET-BB_dst
match dst-tag SUBNET-BB
filter-definition SUBNET-BB
match src-tag SUBNET-BB
or
match dst-tag SUBNET-BB
-----------
Thanks in advance,
-Russell Dwarshuis