Hi All!

nfacctd 1.7.0 config:

nfacctd_port: 2205
nfacctd_time_new: true
nfacctd_account_options: true
nfacctd_as: bgp
bgp_daemon: true
bgp_daemon_ip: X.X.X.X

plugins: print[data]

aggregate[data]: 
src_host,dst_host,src_port,dst_port,proto,src_as,dst_as,in_iface,out_iface
print_output[data]: json
print_output_file[data]: /storage/test.txt
print_output_file_append[data]: false

Log bgp:
INFO ( default/core/BGP ): [Y.Y.Y.Y] BGP_OPEN: Local AS: MYASNUM Remote AS: 
MYASNUM HoldTime: 90


For any traffic that has src_host or dst_host from my AS (MYASNUM) the as_src 
or as_dst field is equal to "0". Here are a few lines from the file test.txt:

{"event_type": "purge", "as_src": 0, "as_dst": 15169, "iface_in": 546, 
"iface_out": 755, "ip_src": "MY_AS_NET", "ip_dst": "8.8.8.8", "port_src": 
51858, "port_dst": 53, "ip_proto": "udp", "packets": 1, "bytes": 86}
{"event_type": "purge", "as_src": 26415, "as_dst": 0, "iface_in": 755, 
"iface_out": 507, "ip_src": "192.33.14.30", "ip_dst": "MY_AS_NET", "port_src": 
53, "port_dst": 37118, "ip_proto": "udp", "packets": 1, "bytes": 1034}

as far as I understood by parsing test.txt - this value is assigned to all the 
routes received from route-reflector with type "internal".
Is it possible to tell the "aggregate[data]" to use instead of "0" the value 
obtained with BGP_OPEN from the field "Local AS" or "Remote AS"? 


-- 
ANK32-RIPE


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to