[Cflowd] Some more CFLOWD Questions.......

From: Alex Ponnath (alexp@iccinternet.com)
Date: Tue Jul 30 2002 - 12:25:27 PDT

  • Next message: Paul Matthews: "[Cflowd] Corrupt Arts files"

    Hi,

    Upfront I would like to say thanks to all who helped me getting my
    CFLOWD running.
    Now since I am collecting data I see a couple of things which are
    strange.

    Currently I am only seeing inbound traffic based on what I see in my
    files
    Like:
    # ./cfdases 216.158.204.33
    period: 07/30/2002 12:04:40 - 07/30/2002 12:05:43 PDT (1 min, 3 sec)

    ifIndex: 2 (FastEthernet1/0 63.251.231.130)
      srcAS dstAS packets bytes pkts/sec
    bits/sec
      ----- ----- ------------- ------------- -------------
    -------------
        174 18915 24 4431 0
    562
        194 18915 1 76 0
    9
        196 18915 1 62 0
    7
        209 18915 6456 5038100 102
    639758

    Shouldn't there be also some data where my AS which is 18915 the src and
    the remote
    As is the dest AS. I am currently using origin-as in the cisco flow
    export, could that
    be the reason ?? I am not interested which peer gets the traffic but
    more like where
    does the traffic actually terminate as far as AS goes.

    Next question I have is if there is a way to use cfdases to get a report
    for a larger
    Time frame then a couple of minutes.

    Last but not least I am wondering what the best way is to create a daily
    report which shows
    Me the in and outbound traffic by AS nbr.

    Thanks

    Alex

     

    _______________________________________________
    Cflowd mailing list
    Cflowd@caida.org
    http://login.caida.org/mailman/listinfo/cflowd



    This archive was generated by hypermail 2.1.4 : Tue Jul 30 2002 - 12:45:28 PDT