From per.hakansson at speedapp.se  Sat Mar  9 21:12:33 2013
From: per.hakansson at speedapp.se (=?utf-8?Q?Per_H=C3=A5kansson?=)
Date: Sat, 9 Mar 2013 11:12:33 +0100
Subject: [netflow-tools] Can softflowd read from stdin?
Message-ID: <565EE612-BBB0-43BB-836E-036FDBC321CC@speedapp.se>

Hello All

I try to find out if softflowd can read a pcap-'stream' from standard input? I know that softflowd can read from file with '-r file', but I need to read from a unix | (pipe) like tcpdump can do with 'tcpdump -r -'. Is it already possible today or is it easy to add it somewhere in the code?

I'm sorry if its a stupid Q. Mayby this is easy if you have better knowledge then I have in unix/linux. 

Regards
- Per H?kansson

From johnf at zioncluster.ca  Sun Mar 10 04:03:48 2013
From: johnf at zioncluster.ca (John Marrett)
Date: Sat, 09 Mar 2013 12:03:48 -0500
Subject: [netflow-tools] Can softflowd read from stdin?
In-Reply-To: <565EE612-BBB0-43BB-836E-036FDBC321CC@speedapp.se>
References: <565EE612-BBB0-43BB-836E-036FDBC321CC@speedapp.se>
Message-ID: <513B6B74.80607@zioncluster.ca>

Per,

> I try to find out if softflowd can read a pcap-'stream' from standard input? I know that softflowd can read from file with '-r file', but I need to read from a unix | (pipe) like tcpdump can do with 'tcpdump -r -'. Is it already possible today or is it easy to add it somewhere in the code?

Yes, it should be able to read from stdin using -r -, at least based on 
my understanding of the source [1] and function it calls ( 
pcap_open_offline [2] ).

Have your tried it; is it not working properly for you?

[1] http://code.google.com/p/softflowd/source/browse/softflowd.c#1388
[2] http://www.manpagez.com/man/3/pcap_open_offline/

-JohnF

From per.hakansson at speedapp.se  Wed Mar 13 02:58:13 2013
From: per.hakansson at speedapp.se (=?utf-8?Q?Per_H=C3=A5kansson?=)
Date: Tue, 12 Mar 2013 16:58:13 +0100
Subject: [netflow-tools] Can softflowd read from stdin?
In-Reply-To: <513B6B74.80607@zioncluster.ca>
References: <565EE612-BBB0-43BB-836E-036FDBC321CC@speedapp.se>
 <513B6B74.80607@zioncluster.ca>
Message-ID: <CCE235EF-1F3D-4299-99C1-AA16EA1BAB3B@speedapp.se>

Hello John

Thanks for the answer. Sorry I did not try it out. I did ask so I know if it was any use of setting up my different machines.

I have now learned that the '-' seems to be a unix feature for stdin, not just as I beleived, only a tcpdump feature (I'm still a unix noob). I did get my env. up and forward a pcap stream to my softflowd-machine and it did works great!

Thanks for the development of softflowd.

Regards
Per H?kansson


9 mar 2013 kl. 18:03 skrev John Marrett <johnf at zioncluster.ca>:

> Per,
> 
>> I try to find out if softflowd can read a pcap-'stream' from standard input? I know that softflowd can read from file with '-r file', but I need to read from a unix | (pipe) like tcpdump can do with 'tcpdump -r -'. Is it already possible today or is it easy to add it somewhere in the code?
> 
> Yes, it should be able to read from stdin using -r -, at least based on my understanding of the source [1] and function it calls ( pcap_open_offline [2] ).
> 
> Have your tried it; is it not working properly for you?
> 
> [1] http://code.google.com/p/softflowd/source/browse/softflowd.c#1388
> [2] http://www.manpagez.com/man/3/pcap_open_offline/
> 
> -JohnF