[flow-tools] mis-configuration or just mis-reading output?

[sthaug@nethelp.no]

> When I look at the output, the octets field seems rather large.  If I'm not wrong, octets is bytes, correct?  What I am looking at on my results just doesnt seem to be correct at all if that is the case.  For example, and this is just one line from the output, the total amount of bytes is in the gigabytes:
> 
> IPaddr                  flows            octets                   packets
> 192.168.1.117    165415         882216081258     1971365474

Over what time have you gathered the Netflow statistics? As an example,
this is 22 Mbyte/s avaraged over 24 hours. Maybe too much, maybe not.

A long shot: Do you have a 7206VXR with NSE-1? There are known PXF bugs
which result in completely invalid (and very large) Netflow counters.

Steinar Haug, Nethelp consulting, sthaug@nethelp.no