[netflow-tools] flowd-reader with stats

[Otto]

Hi Thorhallur. I tested the attached patches in FreeBSD on version 
flowd-0.9.1. I'm interested if that is of any help in speeding things up 
for you.

cd flowd-0.9.1

Need to run configure first to build the make file, then patch it, 
build, install.

patch -p0 <flowd-reader.c.stats.patch
patch -p0 <Makefile.stats.patch

I tested it with a filter like this: (the target ip address is 
192.168.20.247 and I discard any local traffic)

# testFilterOut.fil
discard src !192.168.20.247/32
discard dst 192.168.0.0/19

 > cat /usr/flows/eth0/2011/2011-12/2011-12-07/* | ./flowd-reader -s -f 
/usr/flows/eth0/filters/testFilterOut.fil -

Flow Statistics

IPv4
Total Flows   : 262921
Total Bytes   : 3819349208
Total Packets : 9070763

IPv6
Total Flows   : 0
Total Bytes   : 0
Total Packets : 0


Regards,
Otto.

On 7/12/2011 4:38 AM, Þórhallur Sverrisson wrote:
> I for one am interested, I have been using awk and such which is slow.
>
> Best regards,
>
> Thorhallur
>
> On 6.12.2011, at 17:59, "Otto"<mworld at twbc.net>  wrote:
>
>> Hi. I added some code to flowd-reader. Is any one interested in being able to do this ? (inspired by flow-tools flow-stat). I found it helpful for debugging etc. It would be great to know how other people use flowd to gather statistics etc.
>>
>> flowd-reader -s flowd-2011-12-07-030500
>>
>> Flow Statistics
>>
>> IPv4
>> Total Flows   : 3349
>> Total Bytes   : 32372372
>> Total Packets : 71252
>>
>> IPv6
>> Total Flows   : 1017
>> Total Bytes   : 2014163
>> Total Packets : 7263
>>
>> Regards,
>> Otto.
>>
>> _______________________________________________
>> netflow-tools mailing list
>> netflow-tools at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/netflow-tools

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: flowd-reader.c.stats.patch
URL: <http://lists.mindrot.org/pipermail/netflow-tools/attachments/20111207/080fdc9c/attachment.ksh>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: Makefile.stats.patch
URL: <http://lists.mindrot.org/pipermail/netflow-tools/attachments/20111207/080fdc9c/attachment-0001.ksh>