[netflow-tools] softflowd timeouts

screw.badluck at seznam.cz screw.badluck at seznam.cz
Tue May 3 23:06:35 EST 2011


Hi, 
 does timeouts work when reading data from file?

 Also with some connections, the end_time is far in the future than it should be. At time of "wrong" end_time new connection with same SRC/DST IP/PORT is made and therefore the old flow is expired (at least that's what i think). This would even works though, but it is expired with the new connection's SYN packet timetimestamp as end_time.
 The previous connection is ended by both side sending. 
 I tried to eliminate this by using -t tcp.fin 10, but with no effect. Same for "general", "tcp" and "maxlife".

 Thank you for any hints.


More information about the netflow-tools mailing list