Hi Emanuel,
I think you are looking for (i admit, non-intuitive) 'peer_src_ip' primitive: $ nfacctd -a | grep peer_src_ip peer_src_ip : IP address or identificator of telemetry exporting device Without the grep you can see all supported primitives by the nfacctd release you are using along with a text explanation. Paolo On Sun, Apr 12, 2020 at 06:55:26PM -0400, Emanuel dos Reis Rodrigues wrote: > Hello guys, > > I implemented nfacctd acting as a Netflow collector using pmacct. It is > working perfectly and writing the flows to a Kafka topic which I have an > application processing it. > > Following is my configuration: > > kafka_topic: netflow > kafka_broker_host: Kafka-host > kafka_broker_port: 9092 > kafka_refresh_time: 1 > daemonize: true > plugins: kafka > pcap_interface: enp0s8 > nfacctd_ip: 192.168.1.100 > nfacctd_port: 9995 > aggregate: src_host, dst_host, timestamp_start, timestamp_end, src_port, > dst_port, proto > > Currently, there is only one Netflow exporter sending data to this > demon and I would like to add another exporter. The problem is that I am > not finding a way to differentiate the flows coming from different > exporters. > > Let's say I have the exporter A currently sending data to nfacctd running > at port 9995 and the data is being written to Kafka topic Netflow. > > Now I want a new exporter B to start sending data to nfacctd port 9996 which > will be running as a separate demon ( just because I though so, not sure > yet if it is a necessary approach) and writing the data to the > same Netflow topic in Kafka. > > When the data comes from Kafka to my application, I cannot tell from > which exporter the data came from. I would need some sort of identification > in order to make this differentiation. It is important for me, because my > application may treat differently Netflow traffic coming from these > two Netflow exporters. > > Thanks in advance. > > Emanuel > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
