Hi guys i'm experiencing following issue, hope someone can explain me what's happening.
I got a pcap with a dump of udp packets containing netflow data. I've used tcprewrite and tcpreplay to replicate the traffic to a VM where nfcapd is listening. All seems working good till when I dump nfcapd binary with nfdumpi see flows from january/february/march (where it's supposed to be just from April) among correct flows. I've tried to look for source addresses inside the original pcap with wireshark, with no luck.
Where is this strange traffic among the pcap? why is this happening? is cisco/nfcapd or maybe nfdump having problems somehow?