Re: [pmacct-discussion] Traffic count only for certain networks

[Paolo Lucente]

Hi Slava,

On Wed, Sep 23, 2009 at 11:50:10PM +0300, Slava Dubrovskiy wrote:

> I have found other solution. With the help pre_tag_map.
> From networks-ua-ix.list I have made pretag.map in sort:
> id=1    ip=192.168.21.1 filter='net 173.194.0.0/24'
> id=1    ip=192.168.21.1 filter='net 188.163.0.0/24'
> id=1    ip=192.168.21.1 filter='net 193.0.227.0/24'
> id=1    ip=192.168.21.1 filter='net 193.0.228.0/24'
> id=1    ip=192.168.21.1 filter='net 193.0.240.0/24'
> id=1    ip=192.168.21.1 filter='net 193.0.247.0/24'
> id=1    ip=192.168.21.1 filter='net 193.9.28.0/24'
> id=1    ip=192.168.21.1 filter='net 193.16.45.0/24'
> ...

Yes, that is indeed yet another viable solution :-)

> And it put tag 1 and 0 in the same ip_src and ip_dst
> 
> mysql> select agent_id,ip_src,ip_dst,bytes from acct_v2 where ip_src
> like '91.206.226.104' and ip_dst like '91.209.165.1';
> +----------+----------------+--------------+--------+
> | agent_id | ip_src         | ip_dst       | bytes  |
> +----------+----------------+--------------+--------+
> |        0 | 91.206.226.104 | 91.209.165.1 | 156040 |
> |        1 | 91.206.226.104 | 91.209.165.1 |  19040 |
> +----------+----------------+--------------+--------+
> 2 rows in set (0.01 sec)
> 
> Can you explain it?

A couple things come to my mind:
* A different router other than 192.168.21.1 which is exporting
  NetFlow data to the collector.
* Using NetFlow v9? If yes, any chance VLAN tags, MPLS labels or
  both are exported as part of the NetFlow record? In such a case
  you would need to refine the filter, ie. 'vlan and ...', 'mpls
  and ...' or 'vlan and mpls and ...'.
* Stale data? The query above doesn't show stamp_inserted and/or
  stamp_updated fields. They might give a clue aswell.
* pre_tag_map containing more than 50000 entries? Dumb question
  but always better to ask and double check.

Let me know.

Cheers,
Paolo


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists