But while sending template record better not to add the unwanted fields like protocol and port. And in case of sending data record also donot add the fields protocol and ports if track level "ip" is selected. In softflowd we are sending all the fields independent of track level but setting unwanted fields to 0.<br>
<br>Regards<br>Koteswar<br><br><div class="gmail_quote">On Mon, Aug 24, 2009 at 12:49 PM, Damien Miller <span dir="ltr"><<a href="mailto:djm@mindrot.org">djm@mindrot.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">On Mon, 24 Aug 2009, Koteswar wrote:<br>
<br>
> Hi<br>
> In sofflowd, If I select track level as "ip" (softflowd -T ip) then it is<br>
> filling other fields like protocol, src port, dst port, tcp flags to 0 and<br>
> sending data flow set. But this is not correct behavior. It should not add<br>
> these fields to data flow set or template flow set so that we can reduce<br>
> exported flow data volume and network load (RFC3957).<br>
> Please clarify if I am wrong?<br>
<br>
</div>The tracking level (-T flag) defines how much of the packets are inspected.<br>
You setting of "ip" is the bare minimum, and does not include Layer-3<br>
information like the protocol and protocol ports. Normally you would only<br>
select this option if you were uninterested in this information.<br>
<br>
If you do want to see source/destination ports and the protocol in use then<br>
I suggest that you specify "-T full" or just leave the -T flag off, since<br>
"full" is the default anyway.<br>
<font color="#888888"><br>
-d<br>
<br>
</font></blockquote></div><br>