Hi Jim,
Could you provide a .pcap file showing the DORA exchange from some
client that contains this option 82 data? I would like to see what is
different. It should look something like this:
2025-01-23 17:58:28 UTC Address: 192.168.20.113 has been assigned for
8 hrs 0 mins 0 secs to a device with hardware address: hwtype=1
d2:4d:e0:33:23:dc connected via relay at address: 192.168.20.1,
identified by circuit-id: 69:67:63:30:2e:32:30 (igc0.20), context: {
"ISC": { "relay-agent-info": { "sub-options": "0x0107696763302E3230" }
} }
Note that the ASCII of the circuit-id is shown in parenthesis
following the hex circuit-id
It is possible that yours is encoded differently? You might need to
make a custom "request-parser-format", "response-parser-format", or
both (see here:
https://kea.readthedocs.io/en/kea-2.6.1/arm/hooks.html#configuring-the-forensic-logging-hooks).
These use the same expression syntax as client-classification (see
here:
https://kea.readthedocs.io/en/kea-2.6.1/arm/classify.html#using-expressions-in-classification).
Thank you,
Darren Ankney
On Tue, Jan 21, 2025 at 4:34 PM Jim Springsteen
<jim.springst...@southslope.com> wrote:
>
> Darren,
>
>
>
> I appreciate your response. I did follow the example and this is what I have
> in my config:
>
> "hooks-libraries": [
>
> {
>
> "library":
> "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_legal_log.so",
>
> "parameters": {
>
> "path": "/var/log/kea",
>
> "base-name": "kea-forensic4"
>
> }
>
> },
>
> But in my kea-forensic4 log, I have this entry:
>
> “identified by circuit-id: 00:04:00:00:00:06 and remote-id:
> 00:06:ac:3a:67:d6:de:f2”
>
>
>
> I have confirmed via tcpdump that the server is receiving a string of
> characters as the circuit ID from my access gear.
>
>
>
> I am not sure what I am missing.
>
>
>
> Thanks,
>
> Jim Springsteen
>
> Data Administrator
>
>
>
> jim.springst...@southslope.com | southslope.com
>
> 319-626-2211 main | 319-665-5334 direct
>
> 980 North Front St, North Liberty, IA 52317
>
>
>
>
> --
> ISC funds the development of this software with paid support subscriptions.
> Contact us at https://www.isc.org/contact/ for more information.
>
> To unsubscribe visit https://lists.isc.org/mailman/listinfo/kea-users.
>
> Kea-users mailing list
> Kea-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/kea-users
--
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
To unsubscribe visit https://lists.isc.org/mailman/listinfo/kea-users.
Kea-users mailing list
Kea-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users
