[netsa-tools-discuss] flowdata storage scattered

[Stefan Gundlach | getit GmbH]

Hello! Is ist possible to let rwflowpack store the data based on the *end time* of the flow?

As stated in the FAQ (https://tools.netsa.cert.org/silk/faq.html#rwfilter-time):

  "note that the repository stores flow records by their start-time"

Our Routers (Juniper) report some rather long running flows (> 2 months), for example VPN sessions. To gather the recent parts of that traffic with rwfilter a lot of disk space has to be searched. This is not very efficient... 

Any suggestions?

Stefan Gundlach 
getit, Dortmund, Germany