Hi Osama, On Thu, May 09, 2013 at 11:13:56AM +0200, Osama Abuelsorour wrote:
> What we are trying to do is to gain insights about traffic from the PE router > towards our core network by applying NetFlow on the aggregate interface > towards the core. Ideally, we want to use the MPLS tags to be able to > identify and aggregate flow statistics coming from the access side. Then > using some external helpers, the MPLS tags can be given meanings rather than > just numbers. Briefly to follow-up on this, to say: * support has now been introduced for MPLS_TOP_LABEL_ADDR (NetFlow v9/ IPFIX field type #47) which is mapped to peer_dst_ip field, ie. where typically BGP next-hop is written to. It would be nice if you could confirm presence of this field in your export (maybe along vendor and model information). * support has also been introduced for top and bottom MPLS labels (top is intuitively MPLS_LABEL_1 whereas bottom is determined dinamically by checking the BoS bit): mpls_label_top and mpls_label_bottom. If a flow has only a single label the value of twos will coincide. Having visibility of the top label value is especially useful to resolve the BGP next-hop in cases in which MPLS_TOP_LABEL_ADDR field is not available; the mpls_label_bottom is key in resolving which L2/L3 MPLS VPN, if any, traffic belongs to. * To further help in distinguishing VPN traffic, a derived primitive has also been made available: mpls_stack_depth. This is all available pulling the code from the CVS. Hope this helps, looking forward at receiving feedback. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
