Hi Emanuel,

I think you are looking for (i admit, non-intuitive) 'peer_src_ip'
primitive:

$ nfacctd -a | grep peer_src_ip
peer_src_ip                      : IP address or identificator of telemetry 
exporting device

Without the grep you can see all supported primitives by the nfacctd
release you are using along with a text explanation.

Paolo

On Sun, Apr 12, 2020 at 06:55:26PM -0400, Emanuel dos Reis Rodrigues wrote:
> Hello guys,
> 
> I implemented nfacctd acting as a Netflow collector using pmacct. It is
> working perfectly and writing the flows to a Kafka topic which I have an
> application processing it.
> 
> Following is my configuration:
> 
> kafka_topic: netflow
> kafka_broker_host: Kafka-host
> kafka_broker_port: 9092
> kafka_refresh_time: 1
> daemonize: true
> plugins: kafka
> pcap_interface: enp0s8
> nfacctd_ip: 192.168.1.100
> nfacctd_port: 9995
> aggregate: src_host, dst_host, timestamp_start, timestamp_end, src_port,
> dst_port, proto
> 
> Currently, there is only one Netflow exporter sending data to this
> demon and I would like to add another exporter. The problem is that I am
> not finding a way to differentiate the flows coming from different
> exporters.
> 
> Let's say I have the exporter A currently sending data to nfacctd running
> at port 9995 and the data is being written to Kafka topic Netflow.
> 
> Now I want a new exporter B to start sending data to nfacctd port 9996 which
> will be running as a separate demon ( just because I though so, not sure
> yet if it is a necessary approach)  and writing the data to the
> same Netflow topic in Kafka.
> 
> When the data comes from Kafka to my application, I cannot tell from
> which exporter the data came from. I would need some sort of identification
> in order to make this differentiation. It is important for me, because my
> application may treat differently Netflow traffic coming from these
> two Netflow exporters.
> 
> Thanks in advance.
> 
> Emanuel

> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to