Hello,
I'm trying to setup sfacctd to account per-ASN traffic statistics using pmacct 1.6.1 (the latest). It seems to work but the topmost position in the report is dst_asn 0. Is it possible that pmacct can't handle BGP fullview, so portion of ASN<->prefix data is lost within the daemon?



I use pmacct mysql table version 6 with iface_in, iface_out fields added. MariaDB [pmacct]> SELECT iface_out, as_dst, SUM(bytes) AS bytes FROM as_out GROUP BY iface_out, as_dst ORDER BY SUM(bytes) DESC LIMIT 20;
+-----------+--------+----------------+
| iface_out | as_dst | bytes          |
+-----------+--------+----------------+
|       508 |      0 | 14271156862976 |
|       509 |      0 |  8610211954688 |
|       570 |   6849 |  6350382530560 |
|       570 |  25229 |  6203280506880 |
|       570 |  15169 |  3872144621568 |
|       570 |  13188 |  3619018899456 |
|       569 |   4134 |  3502273396736 |
|       567 |  24940 |  2158440415232 |
|       570 |  21343 |  2101956657152 |
|       570 |  39608 |  2061838761984 |
|       570 |      0 |  2005833433088 |
|       570 |  13238 |  1953913880576 |
|       570 |  21219 |  1912485134336 |
|       569 |   3269 |  1716940570624 |
|       570 |  31148 |  1612703350784 |
|       570 |   6876 |  1525952118784 |
|       564 |  15169 |  1316007411712 |
|       570 |   3255 |  1223870398464 |
|       567 | 133774 |   984798167040 |
|       569 |   4837 |   978273566720 |
+-----------+--------+----------------+

As far as I have got AS0 is an "ASN which pmacct doesn't know about" but it can't be so as I announce fullview from routers (which actually route this traffic) to the daemon: if routers don't have that prefix in BGP table it won't be delivered at all (they have 0.0.0.0/0 route to discard). Sflow is sent by Juniper QFX5100 switch, sflow statistics are collected only from internet uplink interfaces.

Here are my configs:

/etc/pmacct/sfacctd.conf:
debug: false
logfile: /var/log/sfacctd.log
pre_tag_map: /etc/pmacct/pre_tag_map
daemonize: false

sfacctd_port:           6345
sfacctd_as_new:         true
sfacctd_ip:             10.7.10.7
sfacctd_renormalize:    true
sfacctd_disable_checks: true

plugin_buffer_size:     20480
plugin_pipe_size:       10240000

sfacctd_net: bgp
sfacctd_as_new: bgp

bgp_daemon: true
bgp_daemon_msglog: false
bgp_peer_src_as_type: bgp
bgp_daemon_ip: 10.7.10.7
bgp_daemon_port: 179
bgp_agent_map: /etc/pmacct/bgp_agent_map


plugins: mysql[as_in], mysql[as_out]
aggregate[as_in]: src_as, in_iface
aggregate[as_out]: dst_as, out_iface
pre_tag_filter[as_in]: 1
pre_tag_filter[as_out]: 2

sql_table[as_in]: as_in
sql_table_version[as_in]: 6
sql_history_since_epoch[as_in]: true

sql_table[as_out]: as_out
sql_table_version[as_out]: 6
sql_history_since_epoch[as_out]: true


sql_locking_style: row
sql_history: 1h
sql_history_roundoff: h
sql_refresh_time: 3600
sql_optimize_clauses: true
sql_multi_values: 140000
sql_cache_entries: 140003

sql_host: 127.0.0.1
sql_db: pmacct
sql_user: pmacct
sql_passwd: passwd



/etc/pmacct/pre_tag_map:
! ingress traffic
! Traffic to one of routers MAC addresses is ingress
set_tag=1 ip=10.7.10.101 filter='ether dst 00:26:88:2a:bf:c0'
set_tag=1 ip=10.7.10.101 filter='ether dst a8:d0:e5:5f:ec:80'

! egress traffic
! Traffic from one of routers MAC addresses is egress
set_tag=2 ip=10.7.10.101 filter='ether src 00:26:88:2a:bf:c0'
set_tag=2 ip=10.7.10.101 filter='ether src a8:d0:e5:5f:ec:80'



/etc/pmacct/bgp_agent_map:
! BGP session with router 1
id=xx.xx.64.1 ip=10.7.10.101

! BGP session with router 2
id=xx.xx.82.1 ip=10.7.10.101

Thanks in advance!

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to