Hello Florian, if you want to update the nfdump files offline, you can use Perl API we have developed [1].
There are several scripts in example directory and download_asn_db and nf_asn_geo_update will do exactly what you want. download_asn_db will download the BGP table dump from RIPE RIS and create a fast database [2] for the next script. nf_asn_geo_update will update the nfdump files with src and dst ASNs using the database created in the previous step. You can tweak the scripts as you want. M. [1] http://search.cpan.org/~tpoder/Net-NfDump/lib/Net/NfDump.pm [2] http://search.cpan.org/~tpoder/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm On 02/09/2015 02:28 PM, Florian Lohoff wrote: > > Hi, > > as we have ASR9k machines with Trident card we are not able to > dump/write BGP attributes in netflow. We are interested in origin > AS of the flow. > > An idea i had was to enrich the ipv6 flows in the nfdump files offline > from MRT dumps written seperately from zebra/quagga or something. > > Has anyone done something like this before? I know there will be > some inaccuracys caused by the delta-t writing the MRT files > and processing the flows. > > Flo > > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
