[c-nsp] cisco-nsp Digest, Vol 87, Issue 93

[Jens Neu]

Peter,
thanks a lot!

best regards from Berlin
Jens Neu
Health Services Network Administration

Phone: +49 (0) 30 68905-2412
Mail: jens.neu at biotronik.de



Peter Haag <peter.haag at switch.ch> 
03/01/2010 08:13 AM
Please respond to
peter.haag at switch.ch


To
peter.haag at switch.ch
cc
cisco-nsp at puck.nether.net, Jens Neu <jens.neu at biotronik.com>
Subject
Re: cisco-nsp Digest, Vol 87, Issue 93






-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Jens,
The time window in the summary lines includes all flows in the flow file 
not
only those passed the filter. It should actually be limited to the 
filtered flows.
However, it does not explain, why you see flows ending in the future.
I'll fix the time window issue.

                 - Peter

Peter Haag wrote:
> 
> Hi Jens,
> I will look into that.
> 
>                - Peter
> 
>> Dear all,
> 
>> I've encountered a strange behavior of nfdump when running it with the 
-s 
>> and -t options. Sometimes it works as expected, sometimes it gives me 
>> strange values in "Time window:", e.g.
> 
>> Time window: 2010-01-01 00:00:22 - 2010-03-13 04:34:32
> 
>> when running with
> 
>> -t 2010/01/01.00:00:00-2010/01/31.00:00:00
> 
>> details see: http://paste.debian.net/61554/
> 
>> what could be the explanation? NTP issues on the router, or qualifies 
for 
>> a bug report?
> 
>> best regards
> 
>> Jens Neu
>> Health Services Network Administration
> 
>> Phone: +49 (0) 30 68905-2412
>> Mail: jens.neu at biotronik.de
> 
>> ------------------------------
> 
>> _______________________________________________
>> cisco-nsp mailing list
>> cisco-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
> 
>> End of cisco-nsp Digest, Vol 87, Issue 93
>> *****************************************
> 

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box,  CH-8021   Zurich, Switzerland
E-mail: peter.haag at switch.ch Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)

iQCVAwUBS4to8P5AbZRALNr/AQL7mAP9E8giNLkq1S012c7RdiyL4OcCIHbWUMEE
WaXyZJ/C4Fg30dUhipZ+AWnmy0W5j10QZzmMSQWH2N5w4F3GIpQPon/jHpMnixx+
zR3HJ2hstCOkDIx2As7+1ym51UTxtqrwpsAO8F1MSUj7pgaGIriebzbtGzCaLs/U
V7zNjaLWvc4=
=d2fd
-----END PGP SIGNATURE-----