Hi Nikolay,
Apologies for the late reply: can you please share your integral config
and the version you are running? For the latter a 'pmacctd -V' would do.
Paolo
On 17/10/24 16:31, Nikolay Kichukov wrote:
Hi folks,
We have a setup where the pmacctd system does not run SNMP daemon so on
the flow receiver we have static mappings, ie:
index 1:
name: lo
description: loopback
speed: 100000
and so on for the rest of the interfaces.
The issue is that on some of our pmacctd deployments, the interface
index differs(even though these are absolutely the same deployments,
we've not yet identified why this so is). Because they differ, not all
flows get properly classified, and we get to see the fallback name
and/or description. Worst case is, interface mismatch, which then gives
wrong data.
Is it possible to somehow combine the pcap_interfaces_map file with the
pre_tag_map and send static interface indexes in the flows? Or use
another mechanism to achieve this?
Our pcap_interfaces_map currently contains the list of interfaces we are
interested in, ie:
ifindex=1 ifname=lo
... and the rest of the interfaces, here we define the ifindex, the way
we want it in the flows.
The pre_tag_map file conatains:
set_tag=1 filter='dst net 127.0.0.0/8' jeq=eval_ifindexes
set_tag=2 filter='src net 127.0.0.0/8' jeq=eval_ifindexes
set_tag=1 filter='dst net ::1/128' jeq=eval_ifindexes
set_tag=2 filter='src net ::1/128' jeq=eval_ifindexes
...
for the direction and
set_tag2=1 filter='dst host 127.0.0.1' label=eval_ifindexes
set_tag2=1 filter='src host 127.0.0.1'
set_tag2=1 filter='dst host ::1'
set_tag2=1 filter='src host ::1'
...
for the index.
So for the interface that got the unexpected index, the set_tag2 would
have some random number, which we wanted to be fixed and static.
Any way to bind the interfaces map index and set_tag2 index so we end up
sending flows with fixed interface indexes for the specific interfaces
in all our deployments?
Thank you!
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
