Re: [pmacct-discussion] IPv4 and IPv6 sFlow BGP AS
Dears,
Just for the archives: this has been solved by this commit:
https://github.com/pmacct/pmacct/commit/0da36b1aba053128532d6c1342e4f777a46b0041
Cheers,
Paolo
On Sat, Dec 03, 2016 at 01:24:47AM +0200, Сергей Горшков wrote:
> Hi Paolo, thank you for the answer
>
> root@pmacct:/etc/pmacct# cat bgp_agent.map
> bgp_ip=176.**.**.252 ip=0.0.0.0/0filter='ip'
> bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0filter='ip6'
>
> Unfortunately, it did not help:-(
> Running takes place perfectly
> Dec 03 01:07:22 INFO ( default/core ): Trying to (re)load map:
> /etc/pmacct/bgp_agent.map
> Dec 03 01:07:22 INFO ( default/core ): map
> '/etc/pmacct/bgp_agent.map' successfully (re)loaded.
> Dec 03 01:07:22 INFO ( default/core/BGP ): maximum BGP peers allowed: 4
> Dec 03 01:07:22 INFO ( default/core/BGP ): waiting for BGP data on :::179
> Dec 03 01:07:24 INFO ( default/core/BGP ): BGP peers usage: 1/4
> Dec 03 01:07:24 INFO ( default/core/BGP ): Capability: MultiProtocol
> [1] AFI [1] SAFI [1]
> Dec 03 01:07:24 INFO ( default/core/BGP ): Capability: 4-bytes AS
> [41] ASN [5**81]
> Dec 03 01:07:24 INFO ( default/core/BGP ): [Id: 31.**.**.2]
> BGP_OPEN: Asn: 5**81 HoldTime: 240
> Dec 03 01:07:27 INFO ( default/core ): waiting for sFlow data on :::6343
> Dec 03 01:07:27 INFO ( default/mysql ): cache entries=32771 base
> cache memory=11369224 bytes
> Dec 03 01:08:01 INFO ( default/mysql ): *** Purging cache - START
> (PID: 1239) ***
> Dec 03 01:08:01 INFO ( default/mysql ): *** Purging cache - END
> (PID: 1239, QN: 3618/3618, ET: 0) ***
> Dec 03 01:08:59 INFO ( default/core/BGP ): BGP peers usage: 2/4
> Dec 03 01:08:59 INFO ( default/core/BGP ): Capability: MultiProtocol
> [1] AFI [2] SAFI [1]
> Dec 03 01:08:59 INFO ( default/core/BGP ): Capability: 4-bytes AS
> [41] ASN [5**81]
> Dec 03 01:08:59 INFO ( default/core/BGP ): [Id: 176.**.**.97]
> BGP_OPEN: Asn: 5**81 HoldTime: 180
>
> But here's the result of a
> +--+--+++-+---+--+--+--+-+---+---+-+-+
> | agent_id | vlan | as_src | as_dst | ip_src | ip_dst
> | src_port | dst_port | ip_proto | packets | bytes | flows |
> stamp_inserted | stamp_updated |
> +--+--+++-+---+--+--+--+-+---+---+-+-+
> |0 | 3855 | 0 | 0 | 2001:4860::1:0:893c |
> 2001:67c:2d40::47 |0 |0 | ipv6-i | 1 | 214 |
> 0 | 2016-12-03 01:00:00 | 2016-12-03 01:14:01 |
> +--+--+++-+---+--+--+--+-+---+---+-+-+
> and
> |0 | 3800 | 0 | 0 | 31.43.61.166 |
> 185.38.12.42 |56911 | 80 | tcp | 1 |
> 64 | 0 | 2016-12-03 01:00:00 | 2016-12-03 01:08:01 |
>
> Perhaps this will give a little more information to solve the problem
> Sfacct version
> #sfacctd -V
> sFlow Accounting Daemon, sfacctd 1.5.2 (20150907-00)
> --build=x86_64-linux-gnu
> --prefix=/usr '--includedir=${prefix}/include'
> '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info'
> --sysconfdir=/etc
> --localstatedir=/var
> --disable-silent-rules '--libdir=${prefix}/lib/x86_64-linux-gnu'
> '--libexecdir=${prefix}/lib/x86_64-linux-gnu'
> --disable-maintainer-mode
> --disable-dependency-tracking
> --enable-mmap
> --enable-pgsql
> --with-pgsql-includes=/usr/include/postgresql
> --enable-mysql
> --enable-sqlite3
> --enable-ipv6
> --enable-v4-mapped
> --enable-64bit
> --enable-threads
> --enable-jansson
> --enable-geoip
> --enable-rabbitmq
> ---
> Database
> create table acct_v6 (
> agent_id INT(4) UNSIGNED NOT NULL,
> class_id CHAR(16) NOT NULL,
> vlan INT(2) UNSIGNED NOT NULL,
> as_src INT(4) UNSIGNED NOT NULL,
> as_dst INT(4) UNSIGNED NOT NULL,
> ip_src CHAR(15) NOT NULL,
> ip_dst CHAR(15) NOT NULL,
> src_port INT(2) UNSIGNED NOT NULL,
> dst_port INT(2) UNSIGNED NOT NULL,
> ip_proto CHAR(6) NOT NULL,
> packets INT UNSIGNED NOT NULL,
> bytes BIGINT UNSIGNED NOT NULL,
> flows INT UNSIGNED NOT NULL,
> stamp_inserted DATETIME NOT NULL,
> stamp_updated DATETIME,
> PRIMARY KEY (agent_id, class_id, vlan, as_src, as_dst, ip_src,
> ip_dst, src_port, dst_port, ip_proto, stamp_inserted)
> );
>
> For suggestions, critics, bugs, contact me: Paolo Lucente
> .
>
> 03.12.2016 0:03, Paolo Lucente пишет:
> >Hi Sergey,
> >
> >I guess what you need is to refine your bgp_agent_map as follows:
> >
> >bgp_ip=176.**.**.252 ip=0.0.0.0/0filter='ip'
> >bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0filter='ip6'
> >
> >Let me know if this works for you.
> >
> >Cheers,
> >P
Re: [pmacct-discussion] IPv4 and IPv6 sFlow BGP AS
Hi Paolo, thank you for the answer
root@pmacct:/etc/pmacct# cat bgp_agent.map
bgp_ip=176.**.**.252 ip=0.0.0.0/0filter='ip'
bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0filter='ip6'
Unfortunately, it did not help:-(
Running takes place perfectly
Dec 03 01:07:22 INFO ( default/core ): Trying to (re)load map:
/etc/pmacct/bgp_agent.map
Dec 03 01:07:22 INFO ( default/core ): map '/etc/pmacct/bgp_agent.map'
successfully (re)loaded.
Dec 03 01:07:22 INFO ( default/core/BGP ): maximum BGP peers allowed: 4
Dec 03 01:07:22 INFO ( default/core/BGP ): waiting for BGP data on :::179
Dec 03 01:07:24 INFO ( default/core/BGP ): BGP peers usage: 1/4
Dec 03 01:07:24 INFO ( default/core/BGP ): Capability: MultiProtocol [1]
AFI [1] SAFI [1]
Dec 03 01:07:24 INFO ( default/core/BGP ): Capability: 4-bytes AS [41]
ASN [5**81]
Dec 03 01:07:24 INFO ( default/core/BGP ): [Id: 31.**.**.2] BGP_OPEN:
Asn: 5**81 HoldTime: 240
Dec 03 01:07:27 INFO ( default/core ): waiting for sFlow data on :::6343
Dec 03 01:07:27 INFO ( default/mysql ): cache entries=32771 base cache
memory=11369224 bytes
Dec 03 01:08:01 INFO ( default/mysql ): *** Purging cache - START (PID:
1239) ***
Dec 03 01:08:01 INFO ( default/mysql ): *** Purging cache - END (PID:
1239, QN: 3618/3618, ET: 0) ***
Dec 03 01:08:59 INFO ( default/core/BGP ): BGP peers usage: 2/4
Dec 03 01:08:59 INFO ( default/core/BGP ): Capability: MultiProtocol [1]
AFI [2] SAFI [1]
Dec 03 01:08:59 INFO ( default/core/BGP ): Capability: 4-bytes AS [41]
ASN [5**81]
Dec 03 01:08:59 INFO ( default/core/BGP ): [Id: 176.**.**.97] BGP_OPEN:
Asn: 5**81 HoldTime: 180
But here's the result of a
+--+--+++-+---+--+--+--+-+---+---+-+-+
| agent_id | vlan | as_src | as_dst | ip_src |
ip_dst| src_port | dst_port | ip_proto | packets | bytes |
flows | stamp_inserted | stamp_updated |
+--+--+++-+---+--+--+--+-+---+---+-+-+
|0 | 3855 | 0 | 0 | 2001:4860::1:0:893c |
2001:67c:2d40::47 |0 |0 | ipv6-i | 1 | 214 |
0 | 2016-12-03 01:00:00 | 2016-12-03 01:14:01 |
+--+--+++-+---+--+--+--+-+---+---+-+-+
and
|0 | 3800 | 0 | 0 | 31.43.61.166 |
185.38.12.42 |56911 | 80 | tcp | 1 | 64
| 0 | 2016-12-03 01:00:00 | 2016-12-03 01:08:01 |
Perhaps this will give a little more information to solve the problem
Sfacct version
#sfacctd -V
sFlow Accounting Daemon, sfacctd 1.5.2 (20150907-00)
--build=x86_64-linux-gnu
--prefix=/usr '--includedir=${prefix}/include'
'--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info'
--sysconfdir=/etc
--localstatedir=/var
--disable-silent-rules '--libdir=${prefix}/lib/x86_64-linux-gnu'
'--libexecdir=${prefix}/lib/x86_64-linux-gnu' --disable-maintainer-mode
--disable-dependency-tracking
--enable-mmap
--enable-pgsql
--with-pgsql-includes=/usr/include/postgresql
--enable-mysql
--enable-sqlite3
--enable-ipv6
--enable-v4-mapped
--enable-64bit
--enable-threads
--enable-jansson
--enable-geoip
--enable-rabbitmq
---
Database
create table acct_v6 (
agent_id INT(4) UNSIGNED NOT NULL,
class_id CHAR(16) NOT NULL,
vlan INT(2) UNSIGNED NOT NULL,
as_src INT(4) UNSIGNED NOT NULL,
as_dst INT(4) UNSIGNED NOT NULL,
ip_src CHAR(15) NOT NULL,
ip_dst CHAR(15) NOT NULL,
src_port INT(2) UNSIGNED NOT NULL,
dst_port INT(2) UNSIGNED NOT NULL,
ip_proto CHAR(6) NOT NULL,
packets INT UNSIGNED NOT NULL,
bytes BIGINT UNSIGNED NOT NULL,
flows INT UNSIGNED NOT NULL,
stamp_inserted DATETIME NOT NULL,
stamp_updated DATETIME,
PRIMARY KEY (agent_id, class_id, vlan, as_src, as_dst, ip_src,
ip_dst, src_port, dst_port, ip_proto, stamp_inserted)
);
For suggestions, critics, bugs, contact me: Paolo Lucente
.
03.12.2016 0:03, Paolo Lucente пишет:
Hi Sergey,
I guess what you need is to refine your bgp_agent_map as follows:
bgp_ip=176.**.**.252 ip=0.0.0.0/0 filter='ip'
bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0 filter='ip6'
Let me know if this works for you.
Cheers,
Paolo
On Fri, Dec 02, 2016 at 08:09:07PM +0200, Сергей Горшков wrote:
Hi all.
I need your help because I am in a deadlock
My config
#cat sfacctd.conf
! sfacctd configuration
!
!
!
daemonize: true
interface: any
pidfile:/var/run/sfacctd.pid
syslog: daemon
logfile:/var/log/sfacct.log
!
sfacctd_as_new: bgp
bgp_daemon:
Re: [pmacct-discussion] IPv4 and IPv6 sFlow BGP AS
Hi Sergey, I guess what you need is to refine your bgp_agent_map as follows: bgp_ip=176.**.**.252 ip=0.0.0.0/0 filter='ip' bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0 filter='ip6' Let me know if this works for you. Cheers, Paolo On Fri, Dec 02, 2016 at 08:09:07PM +0200, Сергей Горшков wrote: > Hi all. > > I need your help because I am in a deadlock > > My config > > #cat sfacctd.conf > ! sfacctd configuration > ! > ! > ! > daemonize: true > interface: any > pidfile:/var/run/sfacctd.pid > syslog: daemon > logfile:/var/log/sfacct.log > ! > sfacctd_as_new: bgp > bgp_daemon: true > bgp_agent_map: /etc/pmacct/bgp_agent.map > ! > aggregate: tag,vlan,src_as,dst_as,src_host,dst_host,src_port,dst_port,proto > ! > plugins:mysql > sql_db: pmacct > sql_table_version: 6 > sql_table: acct_v6 > sql_host: localhost > sql_user: * > sql_passwd: * > sql_refresh_time: 60 > sql_optimize_clauses: true > sql_history:1h > sql_history_roundoff: h > sql_locking_style: row > -- > > # cat bgp_agent.map > bgp_ip=176.**.**.252 ip=0.0.0.0/0 > bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0 > -- > In this configuration, all IP6 addresses obtained AS 0 > > select * from acct_v6 where ip_src like '%2001:4860%'; > +--+--+++-+---+--+--+--+-+---+---+-+-+ > | agent_id | vlan | as_src | as_dst | ip_src | > ip_dst| src_port | dst_port | ip_proto | packets | bytes | > flows | stamp_inserted | stamp_updated | > +--+--+++-+---+--+--+--+-+---+---+-+-+ > |0 | 3855 | 0 | 0 | 2001:4860::8:0:8f90 | > 2001:67c:2d40::47 |0 |0 | ipv6-i | 2 | 428 | > 0 | 2016-12-01 11:00:00 | 2016-12-01 11:35:01 | > > IP4 everything is fine > > |0 | 3905 | 15169 | 50581 | 173.194.21.80 | 31.43.60.150 > | 443 |21668 | tcp | 2 | 3044 | 0 | 2016-12-01 > 11:00:00 | 2016-12-01 11:16:01 | > > If BGP neighbors to change their place > > # cat bgp_agent.map > bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0 > bgp_ip=176.**.**.252 ip=0.0.0.0/0 > > Then get IP6 AS number and get IP4 AS0 > How to make sFacct collated both IP4 and IP6 addresses with an > autonomous system number?? > > > > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
[pmacct-discussion] IPv4 and IPv6 sFlow BGP AS
Hi all. I need your help because I am in a deadlock My config #cat sfacctd.conf ! sfacctd configuration ! ! ! daemonize: true interface: any pidfile:/var/run/sfacctd.pid syslog: daemon logfile:/var/log/sfacct.log ! sfacctd_as_new: bgp bgp_daemon: true bgp_agent_map: /etc/pmacct/bgp_agent.map ! aggregate: tag,vlan,src_as,dst_as,src_host,dst_host,src_port,dst_port,proto ! plugins:mysql sql_db: pmacct sql_table_version: 6 sql_table: acct_v6 sql_host: localhost sql_user: * sql_passwd: * sql_refresh_time: 60 sql_optimize_clauses: true sql_history:1h sql_history_roundoff: h sql_locking_style: row -- # cat bgp_agent.map bgp_ip=176.**.**.252 ip=0.0.0.0/0 bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0 -- In this configuration, all IP6 addresses obtained AS 0 select * from acct_v6 where ip_src like '%2001:4860%'; +--+--+++-+---+--+--+--+-+---+---+-+-+ | agent_id | vlan | as_src | as_dst | ip_src | ip_dst| src_port | dst_port | ip_proto | packets | bytes | flows | stamp_inserted | stamp_updated | +--+--+++-+---+--+--+--+-+---+---+-+-+ |0 | 3855 | 0 | 0 | 2001:4860::8:0:8f90 | 2001:67c:2d40::47 |0 |0 | ipv6-i | 2 | 428 | 0 | 2016-12-01 11:00:00 | 2016-12-01 11:35:01 | IP4 everything is fine |0 | 3905 | 15169 | 50581 | 173.194.21.80 | 31.43.60.150 | 443 |21668 | tcp | 2 | 3044 | 0 | 2016-12-01 11:00:00 | 2016-12-01 11:16:01 | If BGP neighbors to change their place # cat bgp_agent.map bgp_ip=2001:**:**:1::11 ip=0.0.0.0/0 bgp_ip=176.**.**.252 ip=0.0.0.0/0 Then get IP6 AS number and get IP4 AS0 How to make sFacct collated both IP4 and IP6 addresses with an autonomous system number?? ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
