[netflow-tools] flowd-reader export

Florian Weimer fw at deneb.enyo.de
Tue Mar 28 23:00:50 EST 2006


* Murray Shields:

> Makes sense to me. Any holes in this logic?

It might be a very long connection which results in multiple flows.
In this case, the first packet in the two flows is not sent by the
client.


In general, it is quite difficult to reconstruct the roles without TCP
flags export (and the way it is done by some vendors is not really
helpful, either).




More information about the netflow-tools mailing list