nprobe: octetDeltaCount Vs. postOctetDeltaCount
Posted in NetFlow, NetFlow Analyzer, Network Traffic Analysis, Third Party Integration on March 4th, 2010 by Jon MillsWe had a customer approach us the other day with an nprobe issue. Apparently, he could see the NetFlow v9 data in Flow View of Scrutinizer, but he couldn’t report on the data. How come?
He sent us a Wireshark packet capture and brought up Flow View. Flow View is a way to see the raw flows (inclusive of all columns) being exported by a device.
Anyway, in Flow View everything looked normal, but then one of our developers spotted the word ‘post’ in front of a couple of import column names. We (and Scrutinizer) expect to see ‘octetDeltaCount’ and instead, the customer had configured nProbe to kick out ‘postOctetDeltaCount’.
Jon Mills
Marketing & Public Relations Manager
Follow Me On Twitter




