pmacct-discussion  

[pmacct-discussion] aggregate_filter and tcpdump portrange

Enrico Lambertini
Mon, 24 Mar 2008 06:24:46 -0700

hi,
does pmacct support the filter portrange?
this is my pmacct.conf:

daemonize: true
pidfile: /var/run/pmacctd.pid
syslog: daemon
interface: eth0
aggregate: src_port,dst_port,src_host,dst_host
plugin_buffer_size: 2048
plugin_pipe_size: 2048000

plugins: memory[in], memory[out],memory[test],
aggregate[in]: dst_port, dst_host
aggregate_filter[in]: dst host 192.168.1.39
aggregate[out]:src_port, src_host
aggregate_filter[out]: src host 192.168.1.39!aggregate[out]: src_host
aggregate[test]:src_port, src_host,dst_port,dst_host
!! here it is the problem !!
aggregate_filter[test]: src host 192.168.1.39 and dst portrange 79-81
imt_path[in]: /tmp/port_in.pipe
imt_path[out]: /tmp/port_out.pipe
imt_path[test]: /tmp/port_test.pipe

I'm traying to configure pmacct to filter some port: the filter for in and
out work grate but the filter on "test" fail. "pmacctd -s -p
/tmp/port_test.pipe" ignore the filter...

if I use "src host 192.168.1.39 and dst port 80" evereything seems ok

I suppose I'm wrong with the syntax.... any help? thaks

enrico
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists