Ok so I think I have found the issue - When I include the range that the border routers have IP's in where the netflow data is recorded then it includes all the flows and not those that are specified.
Confirmed by adding a partial subnet of the primary /24 and only the specified was displayed in sql. On Fri, Dec 11, 2015 at 7:22 PM, Maoke <[email protected]> wrote: > dear Cameron, > > perhaps you may share some samples of the output in order others or Paolo > himself may easily identify the problem. ;-) > > cheers, > maoke > > 2015-12-11 17:18 GMT+09:00 Cameron Murray <[email protected]>: > >> I checked again with the following: >> >> aggregate_filter[inbound]: dst net 27.122.118.0/24 or 27.122.119.0/24 >> aggregate_filter[outbound]: src net 27.122.118.0/24 or 27.122.119.0/24 >> >> Data outputted is only related to those subnets so I changed to >> >> aggregate_filter[inbound]: dst net 103.17.250.0/24 or 103.17.251.0/24 >> aggregate_filter[outbound]: src net 2103.17.250.0/24 or 103.17.251.0/24 >> >> And again all data not just the subnets specified. >> >> >> On Fri, Dec 11, 2015 at 6:14 PM, Cameron Murray <[email protected] >> > wrote: >> >>> Thanks Ruben however the same results. As soon as I include the 103 >>> ranges it seems to record everything. >>> >>> >>> >>> On Fri, Dec 11, 2015 at 5:55 PM, Ruben Laban <[email protected]> >>> wrote: >>> >>>> Hi, >>>> >>>> On 11-12-2015 08:42, Cameron Murray wrote: >>>> >>>>> I'm at the point where I am collecting data to MySQL however I am >>>>> having >>>>> issues with the following: >>>>> >>>>> aggregate[inbound]: dst_host >>>>> aggregate[outbound]: src_host >>>>> aggregate_filter[inbound]: dst net 27.122.118.0/24 >>>>> aggregate_filter[outbound]: src net 27.122.118.0/24 >>>>> aggregate_filter[inbound]: dst net 27.122.119.0/24 >>>>> aggregate_filter[outbound]: src net 27.122.119.0/24 >>>>> aggregate_filter[inbound]: dst net 103.17.250.0/22 >>>>> aggregate_filter[outbound]: src net 103.17.250.0/22 >>>>> >>>> >>>> Try using this instead: >>>> >>>> aggregate[inbound]: dst_host >>>> aggregate[outbound]: src_host >>>> aggregate_filter[inbound]: dst net 27.122.118.0/24 or 27.122.119.0/24 >>>> or 103.17.250.0/22 >>>> aggregate_filter[outbound]: src net 27.122.118.0/24 or 27.122.119.0/24 >>>> or 103.17.250.0/22 >>>> >>>> Regards, >>>> Ruben >>>> >>>> _______________________________________________ >>>> pmacct-discussion mailing list >>>> http://www.pmacct.net/#mailinglists >>>> >>> >>> >> >> _______________________________________________ >> pmacct-discussion mailing list >> http://www.pmacct.net/#mailinglists >> > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists >
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
