Patch adds support for aggregation based on NATed addresses and ports.
Tested with NEL|NSEL from Cisco ASR and ip-netflow linux module.
New in v2: add #ifdef NSEL
diff --git a/bin/nflowcache.c b/bin/nflowcache.c
index db60a87..65e3aab 100755
--- a/bin/nflowcache.c
+++ b/bin/nflowcache.c
@@ -155,6 +155,16 @@ static struct aggregate_info_s {
{ "tos", { 1, OffsetTos, MaskTos, ShiftTos }, -1, 0, "%tos" },
{ "srctos", { 1, OffsetTos, MaskTos, ShiftTos }, -1, 0, "%stos" },
{ "dsttos", { 1, OffsetDstTos, MaskDstTos, ShiftDstTos }, -1, 0, "%dtos" },
+
+#ifdef NSEL
+ { "xsrcip", { 8, OffsetXLATESRCv6a, MaskIPv6, ShiftIPv6 }, -1, 0, "%xsa" },
+ { "xsrcip", { 8, OffsetXLATESRCv6b, MaskIPv6, ShiftIPv6 }, -1, 0, NULL },
+ { "xdstip", { 8, OffsetXLATEDSTv6a, MaskIPv6, ShiftIPv6 }, -1, 0, "%xda" },
+ { "xdstip", { 8, OffsetXLATEDSTv6b, MaskIPv6, ShiftIPv6 }, -1, 0, NULL },
+ { "xsrcport", { 2, OffsetXLATEPort, MaskXLATESRCPORT, ShiftXLATESRCPORT }, -1, 0, "%xsp" },
+ { "xdstport", { 2, OffsetXLATEPort, MaskXLATEDSTPORT, ShiftXLATEDSTPORT }, -1, 0, "%xdp" },
+#endif //NSEL
+
{ NULL, { 0, 0, 0, 0}, 0, 0, NULL}
};
diff --git a/man/nfdump.1 b/man/nfdump.1
index 1eec0be..7ad6a48 100755
--- a/man/nfdump.1
+++ b/man/nfdump.1
@@ -206,6 +206,14 @@ mpls9 MPLS label 9
mpls10 MPLS label 10
.br
router Exporting router IP
+.br
+xsrcip NSEL/ASA translated source IP address
+.br
+xdstip NSEL/ASA translated destination IP address
+.br
+xsrcport NSEL/ASA translated source port
+.br
+xdstport NSEL/ASA translated destination port
.RE
.RS 3
.P
------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
