2

I want to filter the netflow records by engine_id, I have tried

nfdump -r <FILE> engine_id 10

and

nfdump -r <FILE> -s engine_id 10

But, it is not working.

What do I do wrong?

Here you find the manual for nfdump.

  • 1
    The man page has engine-id instead of engine_id. Try that, and also quote your filter on the command line, which means that the shell passes it to nfdump as a single parameters, instead of one per word. So try nfdump -r "/path/to/file.ext" "engine-id 10" – Gert van den Berg Oct 26 '15 at 11:18
  • @GertvandenBerg Thanks for the reply. I issued command as you said nfdump -r "nfcapd.201510262034" "engine-id 10", but im getting output like this Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows Summary: total flows: 0, total bytes: 0, total packets: 0, avg bps: 0, avg pps: 0, avg bpp: 0 Time window: 2015-10-26 20:34:49 - 2015-10-26 20:35:51 Total flows processed: 124, Blocks skipped: 0, Bytes read: 6744 Sys: 0.000s flows/second: 124124.1 Wall: 0.000s flows/second: 2530612.2 . Not getting the records(That file has data) – Veerendra Kakumanu Oct 26 '15 at 11:40
1

I don't know we can filter with engine id in netflow records. I found this LINK. My goal is to differentiate the input OVS port in different servers. From that article, we can differentiate the input OVS ports with combination of "add_to_interface=true”, “engine_id=10”.

In that Article

"There is another use case for Engine ID. As I already explained that OVS uses OpenFlow port number as an In/Out interface number in NetFlow flow record. Because OpenFlow port number is a per bridge unique number, there is a chance for these numbers to collide across bridges. To get around this problem, you can set “add_to_interface” to true."

“When this parameter is set to true, the 7 most significant bits of In/Out interface number is replaced with the 7 least significant bits of Engine ID. This will help interface number collision happen less likely.”

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.