Hi, we're currently digging into pmacct and friends and I'm quite happy about its feature set and extensibility.
Now, I face a probably not so uncommon use case, which I'm not able to find a simple solution for: The `aggregate_filter` key allows to filter flows before passing them to a plugin. The filter syntax is supposed to be a pcap-filter: aggregate_filter[inbound]: dst net 192.168.0.0/16 However, is there a way to filter for non-pcap attributes, like src_host_country or nat_event? In my present case, I like to filter the post_nat_src_host to be in a given network, but I don't see a way to do this with aggregate_filter and pcap syntax. The documentation for aggregate_filter says: > This directive can be used in conjunction with 'pre_tag_filter' > (which, in turn, allows to filter tags). Hence, I guess it should be possible to filter for tags. However, trying `tag 1` as filter results in a "syntax error". I appreciate any help or hint how to approach this. Thanks in advance Timo -- Dipl.-Ing.-Inf. Timo Lindhorst email: timo.lindho...@travelping.com phone: +49-391-819099-236 ----------------------- enabling your networks ---------------------- Travelping GmbH phone: +49-391-81 90 99 0 Roentgenstr. 13, 39108 Magdeburg fax: +49-391-81 90 99 299 Koernerstr. 7-10, 10785 Berlin email: i...@travelping.com GERMANY web: http://www.travelping.com Company Registration: Amtsgericht Stendal Reg No.: HRB 10578 Geschaeftsfuehrer: Holger Winkelmann VAT ID No.: DE236673780 --------------------------------------------------------------------- _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
