Hi Brian,

Thanks for getting in touch. Is the flow sample pointed in your email an
example of one that does not get properly tagged? Besides, we should try
to make the issue reproducible: if you could make a pcap trace containing
some flow samples that should be tagged and they are not, and could share
it via unicast email, that would be fantastic. 

Paolo

On Thu, Aug 17, 2017 at 10:06:52AM -0400, Brian Rak wrote:
> I'm trying to classify traffic using pre_tag_map, but I'm running
> into an issue where my tags aren't being applied to all the traffic.
> The tags only seem to get applied to a very small percentage of
> traffic, though I think they should be matching virtually all of it.
> 
> My config is:
> 
> daemonize: true
> sfacctd_port: 6868
> sfacctd_ip: 127.0.0.1
> sfacctd_renormalize: true
> imt_mem_pools_number: 99999
> networks_cache_entries: 599999
> refresh_maps: true
> networks_file: /root/bgp_route_map
> pre_tag_map: /root/pre_tag_map
> sfacctd_as_new: fallback
> plugins: memory[dst_as], memory[src_as]
> aggregate[dst_as]: dst_as, tag
> imt_path[dst_as]: /tmp/pmacct_dst_asn.pipe
> aggregate[src_as]: src_as, tag
> imt_path[src_as]: /tmp/pmacct_src_asn.pipe
> 
> and my pre_tag_map looks like this:
> 
> set_tag=10      ip=10.0.0.1 vlan=30
> set_tag=10      ip=10.0.0.1 vlan=31
> 
> If I capture and decode some inbound traffic with sflowtool, it
> seems to have the vlan set correctly: 
> https://gist.githubusercontent.com/devicenull/c2bf9a201daffcb1c4fa2722de299002/raw/39b5af22cb6795cc6f7ef0b096aec869e1ab78ab/gistfile1.txt
> 
> 
> Any suggestions for debugging here?  I don't really see any
> configuration options that I can use to determine why these maps
> aren't being applied, and I haven't really had any luck in figuring
> out what's going on.
> 
> 
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to