farrokhi/nfdump
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add missing option -M in man page for nfcapd. Issue #103

Browse Source
This commit is contained in:
Peter Haag 2018-04-01 11:04:42 +02:00
parent 9f0fe95633
commit 325aea7cae
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -1,6 +1,7 @@
2018-04-01 2018-04-01
- Add program exit in nfx.c after panic with correupt data file - Add program exit in nfx.c after panic with correupt data file
- Add missing size check when reading nfdump 1.5.x common record blocks - Add missing size check when reading nfdump 1.5.x common record blocks
- Add missing option -M in man page. Issue #103
2018-02-11 2018-02-11
- Add missing json output format in nfdump help text - Add missing json output format in nfdump help text

10
man/nfcapd.1
View File

@ -86,6 +86,16 @@ the final directory is concatenated to \fIbase_directory/sub_hierarchy. Multiple
sources can be specified. All data is sent to the same port specified by \fI\-p\fR. sources can be specified. All data is sent to the same port specified by \fI\-p\fR.
Note: You must not mix \-n option with \-I and \-l. Use either syntax. Note: You must not mix \-n option with \-I and \-l. Use either syntax.
.TP 3 .TP 3
.B -M \fI<dynbase_directory>
Specifies the base directory to store the output files. In contrast to -l -M allows to add
dynamically new flow sources (exporters), as they appear. All exporters send netflow data
to the same port and IP. For each dynamically added source, a new directory is created
with the name of the IPv4/IPv6 address of the exporter. All '.' and ':" in IP addresses
are replaced be '-' e.g. 10.11.12.13 is converted to the directory name 10-11-12-13.
Note: Please make sure to restrict at host level the potential range of IP addresses
which are allowed to connect to nfcapd. Otherwise you risk a potential DoS attack on
nfcapd, as nfcapd has no built in restrictions.
.TP 3
.B -f \fI<pcap_file> .B -f \fI<pcap_file>
Read netflow packets from a give \fIpcap_file\fR instead of the network. This Read netflow packets from a give \fIpcap_file\fR instead of the network. This
requires nfcapd to be compiled with the pcap option and is intended for debugging only. requires nfcapd to be compiled with the pcap option and is intended for debugging only.