farrokhi/nfdump
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add missing option -M in man page for nfcapd. Issue #103

Browse Source
This commit is contained in:
Peter Haag 2018-04-01 11:04:42 +02:00
parent 9f0fe95633
commit 325aea7cae
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -1,6 +1,7 @@
2018-04-01
- Add program exit in nfx.c after panic with correupt data file
- Add missing size check when reading nfdump 1.5.x common record blocks
- Add missing option -M in man page. Issue #103
2018-02-11
- Add missing json output format in nfdump help text

10
man/nfcapd.1
View File

@ -86,6 +86,16 @@ the final directory is concatenated to \fIbase_directory/sub_hierarchy. Multiple
sources can be specified. All data is sent to the same port specified by \fI\-p\fR.
Note: You must not mix \-n option with \-I and \-l. Use either syntax.
.TP 3
.B -M \fI<dynbase_directory>
Specifies the base directory to store the output files. In contrast to -l -M allows to add
dynamically new flow sources (exporters), as they appear. All exporters send netflow data
to the same port and IP. For each dynamically added source, a new directory is created
with the name of the IPv4/IPv6 address of the exporter. All '.' and ':" in IP addresses
are replaced be '-' e.g. 10.11.12.13 is converted to the directory name 10-11-12-13.
Note: Please make sure to restrict at host level the potential range of IP addresses
which are allowed to connect to nfcapd. Otherwise you risk a potential DoS attack on
nfcapd, as nfcapd has no built in restrictions.
.TP 3
.B -f \fI<pcap_file>
Read netflow packets from a give \fIpcap_file\fR instead of the network. This
requires nfcapd to be compiled with the pcap option and is intended for debugging only.