ERF header type IP_COUNTER

Question

Hi All !

In erf.h at the list of ERF headers, there is:

#define ERF_TYPE_IP_COUNTER         13

Does anyone know what it is? What is it for?

Thanks,

Hagay

Answer 1

Yes, Endace, the creator of the ERF file format and thus of the ERF header, does. Unfortunately, they haven't done a very good job of keeping their description of that file format online (it's labeled as "Confidential" in the page footer, the fact that they contribute GPLed code to handle a lot of it nonwithstanding).

The description in their document isn't entirely clear, but it looks as if an ERF_TYPE_IP_COUNTER record has a list of IPv4 addresses and 32-bit counts of packets seen with that address as a source address and with that address as a destination address.