On Wed, Dec 13, 2023 at 13:27:08 +0100, Tomasz Pala wrote: > It's not clear whether "last packet" should be read as "final/closing packet", > but with this field carrying a value of 0 the nfdump doesn't handle the > flowStartMilliseconds value as well. The fix below should address this issue: https://github.com/phaag/nfdump/pull/489 - nevertheless, it needs to be confirmed, pulled and released to take effect. Besides, with flow.end = 0 the connection duration is off (calculated to be some huge negative numher), while flow.end==flow.start makes this implicitly equal to 0. Your call. -- Tomasz Pala <gotar@xxxxxxxxxxxxx>
