n2disk should index pcap file with l7proto without enable --zmq-export-flows
annp1987 opened this issue · comments
Currently, we're intending to use n2disk for saving packet and use npcapextract for extracting a pcap file with l7proto, something looks like: npcapextract -a 9.pcap -i 9.pcap.idx -o test111.pcap -f "l7proto 159". But it won't work if we don't enable --zmq-export-flows. However, enabling export flows via zmq is seem redundant in our case. So it would be great if n2disk support index pcap file with l7proto as default.
@annp1987 this will be available with the next dev build later today, option -E 2