Hi, 16.06.09, 11:53, "Joerg Goltermann" <go...@openbsd.org>:
> pflow(4) is based on pf states, if a pflow tagged state expires, a > flow is created. If you change the pf expire, you can configure > the pflow expiring. > I attached a new version, which should give more correct values for > the "last-time" of a flow. > - Joerg > Index: if_pflow.c > =================================================================== > RCS file: /cvs/src/sys/net/if_pflow.c,v > retrieving revision 1.10 > diff -u -p -r1.10 if_pflow.c > --- if_pflow.c 27 Feb 2009 11:09:36 -0000 1.10 > +++ if_pflow.c 16 Jun 2009 07:13:32 -0000 > @@ -356,8 +356,12 @@ copy_flow_data(struct pflow_flow *flow1, > flow1->flow_octets = htonl(st->bytes[0]); > flow2->flow_octets = htonl(st->bytes[1]); > > - flow1->flow_start = flow2->flow_start = htonl(st->creation * 1000); > - flow1->flow_finish = flow2->flow_finish = htonl(time_second * 1000); > + flow1->flow_start = flow2->flow_start = > + htonl((st->creation - (time_second - time_uptime)) * 1000); > + flow1->flow_finish = flow2->flow_finish = > + htonl((time_uptime - (st->rule.ptr->timeout[st->timeout] ? > + st->rule.ptr->timeout[st->timeout] : > + pf_default_rule.timeout[st->timeout])) * 1000); > flow1->tcp_flags = flow2->tcp_flags = 0; > flow1->protocol = flow2->protocol = sk->proto; > flow1->tos = flow2->tos = st->rule.ptr->tos; Tnanks ! I try it today
