slice the middle of a flow

[Pzoom522]

Dear developers,

Thanks for releasing this beautiful project!

In the "NFPlugins Examples" section, an implementation of FlowSlicer is provided. However, besides sampling the [1st packet, N-th packet] of each flow, I also want to sample the [N-th packet, M-th packet] of each flow. Is it possible?

[abbbe]

I am not an nfstream expert, but here are my 2 cents ;)

In the "NFPlugins Examples" section,

I guess you refer to https://www.nfstream.org/docs/api#flow-slicer.

besides sampling the [1st packet, N-th packet]

What you call packet sampling is actually sampling of expired flows, which can only occur once per a lifetime of a flow I believe. So you probably cannot make streamer return a flow more than once.

If you want to sample packets, you can do so inside on_init() and on_update() methods. Just count the packets and only act (for instanced append to flow.udps.sample_packets) on packets in N-M range.

I think you need to be careful about flow expiration, to make sure you it does not expire too soon, otherwise you might sample another piece of the same flow.

Hope it helps.