Hi Slava, On Thu, Sep 24, 2009 at 05:45:13PM +0300, Slava Dubrovskiy wrote:
> Yes. We use NetFlow v9 from Junuper m7i and NetFlow v5 from ipcad. > And we use vlan, but it's not necessary count it. > What do you mean about "need to refine the filter" ? I would conclude that is not the case then: the m7i AFAIK is not able to encapsulate L2 info within NetFlow v9 and NetFlow v5 doesn't support L2 primitives at all. What i meant by refine the filter is that if NetFlow v9 is encoding VLAN tags or MPLS labels you have to reflect this into the filter. Writing a filter as "net X/24" would not match a VLAN-tagged packet; in such a case you would need a filter like: "vlan and net X/24" (match flows in any VLAN, from/to X/24). Bottom line: filters in pmacct with a-la tcpdump syntax are BPF programs and obey to the libpcap "rules" - like tcpdump does. You should be able to gather relevant info from the local tcpdump man page; otherwise you can just follow this link "http://linux.die.net/man/8/tcpdump"; and look for the words "vlan" or "mpls". Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
