pmacct-discussion  

Re: [pmacct-discussion] pmacct classification error with l7-filter regexps

Paolo Lucente
Sun, 06 Jul 2008 16:05:56 -0700

Hi Sebastien,

please follow me inline.

On Sun, Jul 06, 2008 at 12:02:34PM +0200, S?bastien CRAMATTE wrote:

> ERROR: Protocol name in /etc/pmacct/classifiers//msn-filetransfer.pat 
> too long. A maximum of 16 chars is allowed.

And similar errors. You need just to strip down the first line of the
classifier to make it fit into 16 characthers (including trailing \n\0
or \r\n\0, which makes 13-14 "usable" characthers). 

> What are the solutions to classify traffic based on port  like mysql, 
> ftp ...
> Of course in the database (v7) I've src_port and dst_port but I  mean 
> how it possible to fill class_id  field based on these ports

pmacct doesn't include a way to populate class_id just from port numbers
but this doesn't mean you can't mangle around the field yourself - either
via crontab jobs or triggering external scripts syncronously to pmacct's
sql_refresh_time (look at config directive: sql_trigger_exec).

Hope this helps. Otherwise, please feed more details.

Cheers,
Paolo


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists