nfdump icon indicating copy to clipboard operation
nfdump copied to clipboard

Published 20 hours ago • verified publisher icon phaag

Support for replaying Ipfix file formatted files - RFC 5655

Open r4ravi2008 opened this issue 6 years ago • 3 comments

Hi,

  1. It seems like nfcapd stores files in a proprietary format, where can I find the spec for the same?
  2. Is there any plan to support storing and replaying ipfix messages in this format: https://tools.ietf.org/html/rfc5655

r4ravi2008 avatar Jul 24 '18 21:07 r4ravi2008

The format is basically explained in nffile.h. I plan changes in the file format - however I am not sure if the ietf format will be supported.

phaag avatar Aug 18 '18 15:08 phaag

Just as an FYI, wireshark supports RFC 5655 as well

r4ravi2008 avatar Aug 18 '18 15:08 r4ravi2008

Yes - my focus is speed and efficiency. compatibility is nice but not a top priority.

phaag avatar Aug 19 '18 07:08 phaag

IPFIX files are not going to be supported for now.

phaag avatar Oct 04 '22 08:10 phaag