Re: ports information

From: Edwin D. Viņas (
Date: Thu Dec 13 2001 - 17:21:59 PST

  • Next message: Martin van den Nieuwelaar: "Bare-bones Netflow collector tool, source included"

    Greetings of Peace!!!

    Cflowd files are stored in a different format (of course cflowd format).
    That's why if you'll try to "more" it,
    what you'll see is somewhat like an executable code which is not. In my
    experience, I also tried using the
    different commands of arts++ such as artsdump, artsnet, artsmatrix,
    whatsoever. But, it doesn't output
    the informations pertaining to the source ip, dest ip, bytes, protocol, src
    port, dest port, etc. How do we
    analyze a cflowd format file?

    Good thing there a perl module by Dave Plonka which is called "Cflow"
    module. To give yourself an idea on
    how it works try to analyze his "Flowscan" which uses Cflow to extract
    information in a cflowd file. Although,
    if you're going to read the manpage for Cflow; it's easy to follow.
    Actually, I'm using that module for
    analyzing the cflowd files just like what Flowscan is doing. If you're
    interested to see my perl script that uses
    Cflow to analyze a cflowd file format; don't hesitate to email me and I'll
    give it you. Right now, i'm still
    testing my script for interfacing with a Postgresql database.


    Quezon City, Philippines


    Name: Edwin D. Viņas
    Position: Science Research Specialist I
    Company: Advanced Science and Technology Institute
    Project: PREGINET (
    Personal Website:
    Voice/Text: +63 2 916 375 05 52
    Office: +63 2 435 10 71
    Fax: +63 2 435 10 52

    ----- Original Message -----
    From: "Dmitry Alyabyev" <>
    To: <>
    Sent: Thursday, December 13, 2001 4:21 PM
    Subject: ports information

    > Hello
    > Can someone tell me how (by which program) can I get information
    > about src, dst, src/dst ports, bytes for selected net from flow-file ?
    > We're using arts++-1-1-a6 and when I run artsports it is impossible to
    > get info for one selected net.
    > How can I get over that ?
    > Thanks,
    > --
    > Dimitry
    > --
    > cflowd mailing list

    cflowd mailing list

    This archive was generated by hypermail 2b29 : Thu Dec 13 2001 - 17:30:17 PST