Hi Daryl, You should be looking for:
nfacctd_net: longest nfacctd_as: longest Can you give this a try and see if it works as expected? Longest match of file entries vs default route in BGP should achieve your desired "override" behaviour. Paolo On Fri, Aug 25, 2017 at 04:27:52PM +0930, Daryl Collins wrote: > Hi, > > New to pmacct. I have a router with a partial BGP feed pushing flow > records into nfacctd which is populating the sql database quite nicely. > I'm trying to use a networks_file to improve acccuracy of the src_as field > since most IP's are resolving src_as to the AS that originates 0.0.0.0/0 > from the routers perspective. > > My config looks like: > > daemonize: false > > plugins: mysql > > aggregate: in_iface, src_as, out_iface, src_host, src_net > > nfacctd_port: 2100 > > sql_refresh_time: 30 > > sql_table_version: 6 > > sql_history: 15m > > sql_history_roundoff: h > > sql_table: acct_%Y%m%d_%H%M > > sql_table_schema: /home/pmacct/acct_v6.schema > > networks_file: /home/pmacct/origin_as.txt > > origin_as.txt contains 730k contains of entries that should give me a much > better picture of src_as with entries such as: > 10000,103.29.48.0/22 > > These entries don't appear to be having any impact though. Does anyone > have any suggestions or a better way to do this? I also tried feeding a > full BGP feed into nfacctd and had similar problems so have been trying > this simpler mechanism. > > Thanks, > Daryl > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
