nf_rec->init_time = htonl(nf_flow->created - nf->boot_time);
nf_rec->used_time = htonl(MAX(nf_flow->created, expired->used)
- nf->boot_time);
nf_rec->init_time = htonl(nf_flow->created - nf->boot_time);
nf_rec->used_time = htonl(MAX(nf_flow->created, expired->used)
- nf->boot_time);
/* In NetFlow, the ICMP type and code are concatenated and
* placed in the 'dst_port' field. */
uint8_t type = ntohs(expired->flow.tp_src);
/* In NetFlow, the ICMP type and code are concatenated and
* placed in the 'dst_port' field. */
uint8_t type = ntohs(expired->flow.tp_src);
* traffic. We try to evenly distribute the packet and byte counters,
* so that the bytes-per-packet lengths don't look wonky across the
* records. */
* traffic. We try to evenly distribute the packet and byte counters,
* so that the bytes-per-packet lengths don't look wonky across the
* records. */
} else {
/* In 600 seconds, a 10GbE link can theoretically transmit 75 * 10**10
* == 175 * 2**32 bytes. The byte counter is bigger than that, so it's
} else {
/* In 600 seconds, a 10GbE link can theoretically transmit 75 * 10**10
* == 175 * 2**32 bytes. The byte counter is bigger than that, so it's