Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Hi guys i'm experiencing following issue, hope someone can explain me what's happening.

I got a pcap with a dump of udp packets containing netflow data. I've used tcprewrite and tcpreplay to replicate the traffic to a VM where nfcapd is listening. All seems working good till when I dump nfcapd binary with nfdumpi see flows from january/february/march (where it's supposed to be just from April) among correct flows. I've tried to look for source addresses inside the original pcap with wireshark, with no luck.

Where is this strange traffic among the pcap? why is this happening? is cisco/nfcapd or maybe nfdump having problems somehow?

share|improve this question
I guess it would be hard to answer w/o data examples. –  catpnosis Aug 10 '14 at 6:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.