Hi Paolo,

I have some problems getting info from bgp tables merged with netflow
data. Unfortunately, after going through the wiki/faq/mailling-list I
still can't figure out what is the missing piece from the config files
in order to get these feature working.

I have checked the following things based on suggestions found on the
mailing list:
- Bgp peer ip == netflow agent IP
- bgp_agent_map
- Dump bgp tables fetched from the bgp peer
- Use "bgp" for (pmacctd|nfacctd)_net/as
- Verified bgp peering and netflow

Thanks,

Tamas

Relevant debug/config info

### nfacctd.conf
!BGP
bgp_daemon: true
bmp_daemon: true
bgp_daemon_ip: 216.172.X.X
bgp_daemon_id: 216.172.X.x
bgp_peer_as_skip_subas: true
bgp_daemon_max_peers: 20
bgp_table_dump_file: /tmp/bgp-$peer_src_ip-%H%M.log
bgp_table_dump_refresh_time: 3600
bgp_follow_default: 2
bgp_agent_map: bgp_agents
nfacctd_as: bgp
pmacctd_as: bgp
nfacctd_net: bgp
pmacctd_net: bgp
bgp_aspath_radius: 3
nfacctd_as_new: bgp
bgp_peer_src_as_type: bgp
aggregate[mem]: src_host, dst_host, src_port, dst_port, proto, tag,
src_host_country, dst_host_country, src_host_pocode, dst_host_pocode,
src_as, dst_as, med, as_path

### bgp_agents
/etc/pmacct# cat bgp_agents
bgp_ip=5.159.218.5 ip=5.159.218.5

###Netflow agent
DEBUG ( default/core ): NfV9 agent         : 5.159.218.5:2097
DEBUG ( default/core ): NfV9 template type : flow
DEBUG ( default/core ): NfV9 template ID   : 260
DEBUG ( default/core ):
-------------------------------------------------------------
DEBUG ( default/core ): |    pen     |         field type         |
offset |  size  |
DEBUG ( default/core ): | 0          | in packets         [2    ] |
  0 |      4 |
DEBUG ( default/core ): | 0          | in bytes           [1    ] |
  4 |      4 |
DEBUG ( default/core ): | 0          | IPv4 src addr      [8    ] |
  8 |      4 |
DEBUG ( default/core ): | 0          | IPv4 dst addr      [12   ] |
 12 |      4 |
DEBUG ( default/core ): | 0          | input snmp         [10   ] |
 16 |      4 |
DEBUG ( default/core ): | 0          | output snmp        [14   ] |
 20 |      4 |
DEBUG ( default/core ): | 0          | last switched      [21   ] |
 24 |      4 |
DEBUG ( default/core ): | 0          | first switched     [22   ] |
 28 |      4 |
DEBUG ( default/core ): | 0          | L4 src port        [7    ] |
 32 |      2 |
DEBUG ( default/core ): | 0          | L4 dst port        [11   ] |
 34 |      2 |
DEBUG ( default/core ): | 0          | src as             [16   ] |
 36 |      4 |
DEBUG ( default/core ): | 0          | dst as             [17   ] |
 40 |      4 |
DEBUG ( default/core ): | 0          | BGP IPv4 next hop  [18   ] |
 44 |      4 |
DEBUG ( default/core ): | 0          | IPv4 src mask      [9    ] |
 48 |      1 |
DEBUG ( default/core ): | 0          | IPv4 dst mask      [13   ] |
 49 |      1 |
DEBUG ( default/core ): | 0          | L4 protocol        [4    ] |
 50 |      1 |
DEBUG ( default/core ): | 0          | tcp flags          [6    ] |
 51 |      1 |
DEBUG ( default/core ): | 0          | tos                [5    ] |
 52 |      1 |
DEBUG ( default/core ): | 0          | direction          [61   ] |
 53 |      1 |
DEBUG ( default/core ): | 0          | forwarding status  [89   ] |
 54 |      1 |
DEBUG ( default/core ): | 0          | sampler ID         [48   ] |
 55 |      2 |
DEBUG ( default/core ): | 0          | 234                [234  ] |
 57 |      4 |
DEBUG ( default/core ): | 0          | 235                [235  ] |
 61 |      4 |
DEBUG ( default/core ):
-------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 65

### BGP peer
INFO ( default/core/BGP ): [5.159.218.5] BGP peers usage: 1/50
INFO ( default/core/BGP ): [5.159.218.5] Capability: MultiProtocol [1]
AFI [1] SAFI [1]
INFO ( default/core/BGP ): [5.159.218.5] Capability: 4-bytes AS [41] ASN [34655]
INFO ( default/core/BGP ): [5.159.218.5] BGP_OPEN: Local AS: 34655
Remote AS: 34655 HoldTime: 180
DEBUG ( default/core/BGP ): [5.159.218.5] BGP_KEEPALIVE received
DEBUG ( default/core/BGP ): [5.159.218.5] BGP_KEEPALIVE sent

### pmacct
/etc/pmacct# pmacct -s -T flows,5 -c dst_host_country
TAG         SRC_AS      DST_AS      AS_PATH                  MED
SRC_IP           DST_IP           SRC_PORT  DST_PORT  PROTOCOL
SH_COUNTRY  DH_COUNTRY  SH_POCODE     DH_POCODE     PACKETS
   BYTES
0           0           0           ^$                       0
109.71.162.32    178.187.170.198  1935      4010      tcp         LU
       RU                        659300        2
2904
0           0           0           ^$                       0
46.188.106.58    93.93.53.199     62090     80        tcp         RU
       LU          101194                      1
40
0           0           0           ^$                       0
185.13.90.86     85.29.74.98      443       49498     tcp         LU
       FI                        74130         98
124015
0           0           0           ^$                       0
93.93.51.195     5.228.17.199     80        48324     tcp         LU
       RU                        101194        1
1280
0           0           0           ^$                       0
109.71.161.146   2.86.239.153     443       58337     tcp         LU
       GR                                      1
1400

### Example

Json output from bgp dump
{"timestamp": "2017-11-02 08:41:00", "peer_ip_src": "5.159.218.5",
"event_type": "dump", "afi": 1, "safi": 1, "ip_prefix":
"85.29.64.0/18", "bgp_nexthop": "80.81.192.144", "as_path": "6667
13170", "comms": "6667:900 6667:1000 6667:2000 6667:3000 6667:4002
34655:2 34655:40 34655:401 34655:2002 34655:4010", "origin": 0,
"local_pref": 110, "med": 206}

pmacct output
0           0           0           ^$                       0
185.13.90.86     85.29.74.98      443       49498     tcp         LU
       FI                        74130         98
124015

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to