Hi Alex,

First thing first 1.6.1 is a release of almost 3 years ago, i can't
support that - please upgrade to 1.7.3 or master code. That said i can
confirm pmacctd/uacctd should support PPP-encapsulated traffic. Also, you
may send me a trace of the NFLOG traffic (as captured by tcpdump) via
unicast email for some troubleshooting.

Paolo

On Wed, May 29, 2019 at 12:37:40PM +0300, Alex K wrote:
> Hi All,
> 
> I am facing the following issue:
> 
> I have configured iptables to log packets coming through a ppp interface
> (named sim0) using NFLOG target. These packets are forwarded to uacctd to
> the respective uacctd group, as below, which are printed in a CSV file
> using the print plugin:
> 
> 
> iptables (mangle table):
> -A INPUT -i sim0 -j NFLOG --nflog-group 1 --nflog-size 40 --nflog-threshold
> 10 --nflog-prefix sim0in
> -A FORWARD -i sim0 -j NFLOG --nflog-group 1 --nflog-size 40
> --nflog-threshold 10 --nflog-prefix sim0in
> -A POSTROUTING -o sim0 -j NFLOG --nflog-group 1 --nflog-size 40
> --nflog-threshold 10 --nflog-prefix sim0out
> 
> 
> uacctd config:
> ! Collect traffic on sim0
> daemonize: true
> debug:  true
> promisc:   false
> pidfile:   /var/run/uacctd_sim0.pid
> imt_path:  /tmp/uacctd_sim0.pipe
> !syslog: daemon
> logfile: /var/log/uacct/uacct_sim0.log
> uacctd_group: 1
> plugins: print[in_out_sim0]
> aggregate[in_out_sim0]:src_host,dst_host,src_port,dst_port,proto
> print_output[in_out_sim0]: csv
> print_output_file[in_out_sim0]: /var/lib/uacctd-sim0-%Y%m%d.csv
> print_output_file_append[in_out_sim0]: true
> print_refresh_time: 10
> print_history: 24h
> 
> I receive normally outgoing traffic which is logged at the CSV file.
> Using tcpdump I can see all the in/out traffic and iptables counters are
> rising at the respective chains. The sim0 interface is dynamically brought
> up from a ppp connection.
> 
> Do you have any idea why uacctd is not getting those incoming packets
> (INPUT and FORWARD chain) or how this can be troubleshooted. I am using
> pmacct 1.6.1-1.
> 
> Thank you!
> Alex

> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to