title: Converting a PCAP trace to NetFlow format
body: <p>I would like to convert some PCAP traces to Netflow format for further analysis with netflow tools. Is there any way to do that? </p>
  
  <p>Specifically, I want to use "flow-export" tool in order to extract some fields of interest from a netflow trace as follows: </p>
  
  <pre><code>$ flow-export -f2 -mUNIX_SECS,SYSUPTIME,DPKTS,DOCTETS &lt; mynetflow.trace
  </code></pre>
  
  <p>In this case, the mynetflow.trace file is taken by converting a PCAP file using the following commands:</p>
  
  <pre><code>$ nfcapd -p 12345 -l ./ 
  
  $ softflowd -n localhost:12345 -r mytrace.pcap
  </code></pre>
  
  <p>This, generates a netflow trace but it cannot be used by flow-export correctly, since it is not in the right format. I tried also to pipe the output of the following command to flow-export as follows:</p>
  
  <pre><code>$ flow-import -V1 -z0 -f0 &lt;mynetflow.trace | flow-export -f2 -mUNIX_SECS,SYSUPTIME,DPKTS,DOCTETS
  </code></pre>
  
  <p>but the output of the first command generated zero timestamps. </p>
  
  <p>Any ideas? </p>