From gyhuang at mail.ustc.edu.cn  Fri Sep 19 14:19:27 2008
From: gyhuang at mail.ustc.edu.cn (GuanYao Huang)
Date: Fri Sep 19 14:18:53 2008
Subject: [Flow-tools] A question about NetFlow output format
Message-ID: <421848367.04666@ustc.edu.cn>

Hi, I am a newbie here.

I think NetFlow record itself is not readable, it can only be processed by
flow-tools, which generate some "ft" file. My question is, whether the records in
"ft" file is listed according to flows, that means, different records are
different flows. 

Someone told me that in the original NetFlow record, one record is not necessarily
one flow, some records belong to the same flow.

Since the flow is also defined by a time interval, I can not only use 5 tuples to
find the distinct flow number. 

Thanks.