Hi Carsten, Yes, please. Having a look to a few sample datagrams would be the natural follow-up. Send the capture over privately and we wrap up later on list. Make sure templates are included in the trace for it to be of use.
Cheers, Paolo On Fri, Jul 23, 2010 at 09:32:45PM +0200, InterNetX GmbH - Carsten Schoene wrote: > Hello Paolo, > > thanke for your fast reply, now to your questions: > > * yes, --enable-ipv6 was used at compile time > * i have tried with and without aggregate_filter for our IPv6 subnet > * yes, i can see netflow v9 datagrams containing IPv6 records > > I hope this helps, if you need a sample datagram i can send it over > on monday. > > Regards > Carsten > > Zitat von Paolo Lucente <[email protected]>: > >> Hi Carsten, >> >> A couple of things come to mind: >> >> * Was pmacct compiled with --enable-ipv6 ? >> * Are 'aggregate_filter' directives including the IPv6 subnets you >> want to account for? >> * If, in parallel to nfacctd, you fire up a Wireshark (or tshark); >> by decoding the NetFlow v9 datagrams generated by the probe, can >> you spot the IPv6 records being sent over to the collector? >> >> Basing on the answers to the above questions, we can drill it down >> further. >> >> Cheers, >> Paolo >> >> >> On Fri, Jul 23, 2010 at 07:00:00PM +0200, InterNetX - Carsten Schoene wrote: >>> Hello List, >>> >>> i've setup a nfacctd instance which writes data into mysql, the >>> configuration looks like this: >>> >>> daemonize: true >>> pidfile: /var/run/nfacctd.pid >>> syslog: daemon >>> plugin_pipe_size: 10240000 >>> plugin_buffer_size: 10240 >>> nfacctd_ip: %MY_NFACCTD_HOST% >>> nfacctd_port: 5552 >>> nfacctd_allow_file:/etc/pmacct/nfacctd.allow >>> nfacctd_time_new: true >>> plugins: mysql[in], mysql[out] >>> >>> aggregate[in]: dst_host >>> aggregate[out]: src_host >>> aggregate_filter[in]: dst net %MYNETWORK_A%/18 or dst net %MYNETWORK_B%/19 >>> aggregate_filter[out]: src net %MYNETWORK_A%/18 or src net %MYNETWORK_B%/19 >>> >>> sql_host:localhost >>> sql_user:pmacct >>> sql_passwd:********* >>> sql_optimize_clauses: true >>> sql_refresh_time: 300 >>> sql_history: 5m >>> sql_dont_try_update: true >>> sql_history_roundoff: m >>> sql_table_version: 7 >>> sql_table:acct_v7_%Y%m%d_%H00 >>> sql_table_schema:/etc/pmacct/mysql_v7_table.sql >>> sql_recovery_logfile: /raid/nfacctd_recovery_log >>> sql_multi_values: 16384000 >>> >>> >>> CREATE TABLE IF NOT EXISTS acct_v7_%Y%m%d_%H00 ( >>> id INT UNSIGNED NOT NULL AUTO_INCREMENT, >>> ip_src CHAR(45) NOT NULL, >>> ip_dst CHAR(45) NOT NULL, >>> packets INT UNSIGNED NOT NULL, >>> bytes BIGINT UNSIGNED NOT NULL, >>> flows INT UNSIGNED NOT NULL, >>> stamp_inserted DATETIME NOT NULL, >>> stamp_updated DATETIME, >>> PRIMARY KEY (id), >>> KEY `src_dst_stamps` (ip_src, ip_dst, stamp_inserted, >>> stamp_updated), >>> KEY(ip_src), >>> KEY(ip_dst) >>> ) ENGINE=MyISAM; >>> >>> We are running nprobe which exports netflow v9 data using the >>> following netflow template: >>> %IPV6_SRC_ADDR %IPV6_DST_ADDR %IPV4_SRC_ADDR %IPV4_DST_ADDR >>> %LAST_SWITCHED %FIRST_SWITCHED %IN_BYTES >>> %OUT_BYTES %IN_PKTS %OUT_PKTS %L4_SRC_PORT %L4_DST_PORT %PROTOCOL >>> %TCP_FLAGS %IP_PROTOCOL_VERSION >>> %SRC_TOS %SRC_AS %DST_AS %IPV6_SRC_MASK %IPV6_DST_MASK %SRC_MASK %DST_MASK >>> >>> The problem is, that there are no IPv6 entrys written into the >>> tables, only ipv4 addresses. >>> >>> Any idea or help would be great >>> >>> Regards >>> -- >>> Carsten Sch?ne >>> Leiter Rechenzentrum >>> >>> InterNetX GmbH >>> Maximilianstr. 6 >>> 93047 Regensburg >>> >>> Tel. +49 941 59559-480 >>> Fax +49 941 59579-051 >>> >>> www.internetx.com >>> www.facebook.com/InterNetX >>> www.twitter.com/InterNetX >>> >>> Gesch?ftsf?hrer/CEO: Thomas M?rz >>> Amtsgericht Regensburg, HRB 7142 >>> >>> _______________________________________________ >>> pmacct-discussion mailing list >>> http://www.pmacct.net/#mailinglists >> >> _______________________________________________ >> pmacct-discussion mailing list >> http://www.pmacct.net/#mailinglists >> > > > > -- > Carsten Sch?ne > Leiter Rechenzentrum > > InterNetX GmbH > Maximilianstr. 6 > 93047 Regensburg > > Tel. +49 941 59559-0 > Fax +49 941 59559-50 > > E-Mail: [email protected] > > www.internetx.com > www.facebook.com/InterNetX > www.twitter.com/InterNetX > > Gesch?ftsf?hrer/CEO: Thomas M?rz > Amtsgericht Regensburg, HRB 7142 > > ---------------------------------------------------------------- > This message was sent using IMP, the Internet Messaging Program. > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
