Hi Daryl,

You should be looking for:

nfacctd_net: longest
nfacctd_as: longest

Can you give this a try and see if it works as expected? Longest match
of file entries vs default route in BGP should achieve your desired
"override" behaviour. 

Paolo

On Fri, Aug 25, 2017 at 04:27:52PM +0930, Daryl Collins wrote:
> Hi,
> 
> New to pmacct.  I have a router with a partial BGP feed pushing flow
> records into nfacctd which is populating the sql database quite nicely.
> I'm trying to use a networks_file to improve acccuracy of the src_as field
> since most IP's are resolving src_as to the AS that originates 0.0.0.0/0
> from the routers perspective.
> 
> My config looks like:
> 
> daemonize: false
> 
> plugins: mysql
> 
> aggregate: in_iface, src_as, out_iface, src_host, src_net
> 
> nfacctd_port: 2100
> 
> sql_refresh_time: 30
> 
> sql_table_version: 6
> 
> sql_history: 15m
> 
> sql_history_roundoff: h
> 
> sql_table: acct_%Y%m%d_%H%M
> 
> sql_table_schema: /home/pmacct/acct_v6.schema
> 
> networks_file: /home/pmacct/origin_as.txt
> 
> origin_as.txt contains 730k contains of entries that should give me a much
> better picture of src_as with entries such as:
> 10000,103.29.48.0/22
> 
> These entries don't appear to be having any impact though.  Does anyone
> have any suggestions or a better way to do this?  I also tried feeding a
> full BGP feed into nfacctd and had similar problems so have been trying
> this simpler mechanism.
> 
> Thanks,
> Daryl

> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to