Hello Brian,

Thanks you very much for opening this new issue. As per today, nfsen-ng is not a 1 to 1 replacement for nfsen. There are some features that are not implemented. Concerning your questions / comments:

Single time bin queries

You will notice that when you select a predefined time slot, the button “Copy from graph” is disabled. If you use the zoom to isolate a peak you can then click this button and it will carry forward when you switch from "Graphs" to "Flows" or “Statistics”.

Range selection

Related to the above, if you need a smaller range than 24 hours, you can define your own slot manually by using the zoom and this will become the new time slot used by the two arrows to move back and forward. Your queries will then cover that range. However, for smaller slots than 24 hours, you will lose the visibility of that range under “Flows” and “Statistics”.

Translated source/destination

Not sure I understood this point clearly. I assume we are talking about the output showed in the “Flows” and “Statistics”. Is that correct? The output there needs to be reworked. As far as I remember it’s not flexible enough and we did not implement it as we initially wanted to (lack of time). I do not have a running version of nfsen on hand, does this NAT translation happen automatically or do you have to specify it somewhere?

Minor issues

Thanks for pointing them out.

@mbolli : do you have some time available soon ? We could meet and try to solve some open/reported points ?

You will notice that when you select a predefined time slot, the button “Copy from graph” is disabled. If you use the zoom to isolate a peak you can then click this button and it will carry forward when you switch from "Graphs" to "Flows" or “Statistics”.

Thank you - I was being dense. I didn't notice that the "Copy from graph" button became active after moving the zoom slider.

If I have the 24 hour view open, then I have to move the zoom slider a little to activate "Copy from graph". But it seems if I don't do that, then the same time period is used in the Flows and Statistics pages, so that's fine (now I realise that's the case).

Translated source/destination

Not sure I understood this point clearly.

These are additional fields generated in the netflow data from certain devices, such as firewalls (e.g. Cisco ASA) and some routers which do NAT. The examples I showed were from a Mikrotik router.

Digging further: I built nfdump with --enable-nsel configure flag, and I think this may be a pre-requisite to get these fields. They appear in -o nsel (which is the default when nfdump is built that way), but not in -o line, -o long or -o extended. Also unfortunately not with -o csv either, which is what nfsen-ng uses.

They do appear in -o json though: here's an example.

{
	"type" : "FLOW",
	"sampled" : 0,
	"export_sysid" : 1,
	"t_first" : "2019-11-13T18:44:33.720",
	"t_last" : "2019-11-13T18:44:46.770",
	"proto" : 6,
	"src4_addr" : "216.58.208.110",
	"dst4_addr" : "XX.XXX.XXX.XXX",
	"src_port" : 443,
	"dst_port" : 52979,
	"fwd_status" : 0,
	"tcp_flags" : ".A..S.",
	"src_tos" : 0,
	"in_packets" : 31,
	"in_bytes" : 5950,
	"input_snmp" : 17,
	"output_snmp" : 10,
	"src_xlt_port" : "443",
	"dst_xlt_port" : "52979",
	"src4_xlt_ip" : "216.58.208.110",
	"dst4_xlt_ip" : "10.12.254.120",
	"label" : "<none>"
}

This is probably better than writing a custom fmt:<format> to get them.

You'll also see them described in man nfdump under -A and -s:

            xsrcip     X-late source IP address, if compiled with NSEL support
            xdstip     X-late destination IP address, if compiled with NSEL support
            xsrcport   X-late source port, if compiled with NSEL support
            xdstport   X-late destination port, if compiled with NSEL support

Aside: the Cisco ASA is a more difficult beast again, because the flows it generates are bidirectional: they have in bytes and out bytes as separate columns in the same flow. Due to a quirk of nfdump, the "in bytes" are bytes from src to destination (which most people would think of as "outbound"), and "out bytes" are bytes from destination to src. I do have to deal with ASA sometimes, and it's a pain: because the definition of "src" or "dst" depends on whether the flow originated from the inside or outside, aggregating on src or dst becomes very difficult. (That is: in some flows my internal addresses are "src", and in other flows they are "dst").

One other minor point. When I do Statistics > Statistic for (Any IP Address) > Order by (Byte), the total bytes is not shown as a a column, although I would find it useful. The columns I get are:

(where ip/bytes shows IP address only). But the command nfsen-ng sends is:

/usr/local/bin/nfdump -M '/var/nfsen/profiles-data/live/gw' -R '2019/11/13/nfcapd.201911131845:2019/11/14/nfcapd.201911141835' -n '10' -o 'csv' -s 'ip/bytes'

and the CSV it returns includes additional columns like packets/packets% and bytes/bytes%:

ts,te,td,pr,val,fl,flP,pkt,pktP,byt,bytP,pps,bps,bpp

I guess this was done to reduce screen clutter, but it would be nice to be able to turn on the additional columns (if there is already a way, I can't see it). I see there are a series of checkboxes under the "Search" dropdown, but they are all turned on already.

Translated source/destination
is a showstopper for us unfortunately... NAT translations are crucial.
Unfortunately, because ik like the interface more then the old nfsen...