Hi,

Let me confirm that collecting the ICMP type is partially supported; the
native dst_port primitive is locked to UDP and TCP only - making this
not suitable for NetFlow v5 kind of scenarios; but if using NetFlow v9
and/or IPFIX you could define your own custom primitive via the
aggregate_primitives infrastructure, see also an example here:  

https://github.com/pmacct/pmacct/blob/1.7.4/examples/primitives.lst.example

By the way: you speak collecting NetFlow but your config example is
actually about the 'nfprobe' plugin, that is, generating NetFlow out of
raw traffic. Is that what you are after?

Paolo 

On Sun, Apr 12, 2020 at 04:20:08PM -0400, fireballiso wrote:
> Hi! I've started using pmacctd to replace old netflow collectors for my
> main and test networks, which run both IPv6 and IPv4. It works very
> well, except that I haven't yet found a way to record the ICMP and ICMP6
> types and codes.
> 
> In other collectors, these are often stored in the destination port
> (otherwise unused for ICMP/ICMP6), in the format "A.B", where A is the
> type and B is the code. For example, "3.1" would represent ICMP type 3
> (Destination Unreachable), code 1 (Host Unreachable). I see lots of ICMP
> and ICMP6 flows, but unfortunately, the destination port is always set
> to "0.0", as if nothing is being recorded there.
> 
> A simple config:
> 
> daemonize: true
> !
> interface: net1
> aggregate: src_host, dst_host, src_port, dst_port, proto, tos
> plugins: nfprobe
> nfprobe_receiver: 192.168.14.2:9997
> nfprobe_version: 9
> 
> 
> I haven't found documentation or examples that show how to enable
> recording the types and codes, and no relevant primitives to add to the
> aggregate statement. Would someone be able to tell me how to do this?
> 
> Thank you!
> 
> -Indy
> 
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to