Able to convert current nfdump binary format to older versions?

[indyprime]

Hi! I'm using nfcapd 1.7.1 to capture netflow v9 and save it on one system, which works very well to read with recent versions of nfdump. However, I tried processing the saved netflow on another system that uses version NSEL-NEL1.6.22, and it fails with the error "bad version: 2".

I have seen pages discussing converting old binary formats of saved netflow to be readable with newer nfdump, which is uses nfdump-1.6.17-conv; however, I need to go the other way, and convert new to old. Since it would be very involved to update this legacy system to a later version of nfdump, is there a way to convert the current binary file format (version 2?) to an older format?

Thank you!

Indy

[phaag]

There is no binary, that creates the v1 file format from new v2. That is for good reason. The new format is more flexible and is easier to implement in other project and languages. See also go-nfdump as an example.
The effort to implement the new format for your reader is most likely way less than creating old v1 from v2 binaries. If you don not want to update your reader, you may still use nfdump-1.6.x branch, which is the latest supported 1.6.x version, which still works most likely for your case.

The discussion and the existence of nfdump-1.6.17-conv is due to certain legacy records, which are no longer supported.