we're currently digging into pmacct and friends and I'm quite happy
about its feature set and extensibility.

Now, I face a probably not so uncommon use case, which I'm not able
to find a simple solution for:

The `aggregate_filter` key allows to filter flows before passing them
to a plugin. The filter syntax is supposed to be a pcap-filter:
aggregate_filter[inbound]: dst net

However, is there a way to filter for non-pcap attributes, like
src_host_country or nat_event? In my present case, I like to filter
the post_nat_src_host to be in a given network, but I don't see
a way to do this with aggregate_filter and pcap syntax.

The documentation for aggregate_filter says:
> This directive can be used in conjunction with 'pre_tag_filter'
> (which, in turn, allows to filter tags).
Hence, I guess it should be possible to filter for tags. However,
trying `tag 1` as filter results in a "syntax error".

I appreciate any help or hint how to approach this.

Thanks in advance

Dipl.-Ing.-Inf. Timo Lindhorst

email: timo.lindho...@travelping.com
phone: +49-391-819099-236

----------------------- enabling your networks ----------------------

Travelping GmbH                     phone:  +49-391-81 90 99 0
Roentgenstr.  13, 39108 Magdeburg   fax:    +49-391-81 90 99 299
Koernerstr. 7-10, 10785 Berlin      email:  i...@travelping.com
GERMANY                             web:    http://www.travelping.com

Company Registration: Amtsgericht Stendal        Reg No.:   HRB 10578
Geschaeftsfuehrer: Holger Winkelmann          VAT ID No.: DE236673780

pmacct-discussion mailing list

Reply via email to