Use this example to handle a Flow Info record.
When a flow is unlearned, and the flow learn record gfi option was set
to 1, a flow info record is generated, which can be read with the
NT_FlowRead function. The flow info record contains information on the
use of and metrics for the flow while it was active, such as packet counters and
timestamp.
Note: Flow info records are read from the same flow stream that originally learned
the flows.
Example:
NtFlowInfo_t flowInfo; // For each element in the flow stream queue, print the flow info record. while(NT_FlowRead(flowStream, &flowInfo, 0) == NT_SUCCESS) { std::cout << "NT_FlowRead of flow ID " << flowInfo.id << std::endl << "CSA: Packages: " << flowInfo.packets_a << ", Octets: " << flowInfo.octets_a << std::endl << "CSB: Packages: " << flowInfo.packets_b << ", Octets: " << flowInfo.octets_b << std::endl << "Time stamp: " << flowInfo.ts << std::endl << "TCP flags A: " << flowInfo.flags_a << ", TCP flags B: " << flowInfo.flags_b << std::endl; switch(flowInfo.cause) { case 0: std::cout << "Unlearn cause: Software" << std::endl; break; case 1: std::cout << "Unlearn cause: Timeout" << std::endl; break; case 2: std::cout << "Unlearn cause: TCP flow termination" << std::endl; break; default: std::cout << "Unlearn cause: Not supported" << std::endl; break; } }