Thank you for your help. Appreciate it !

See, I did use it for testing after I sent this email. However, the ip
showed there was the IP from my nfacctd machine, the collector itself. Not
the exporter.

peer_src_ip                      : IP address or identificator of telemetry
exporting device

In fact, it may have todo with the fact I currently have an SSH tunnel with
socat with the remote machine in order to collect the data. This may be the
reason why which is definitively not a ordinary condition. :)

I am wondering if I could use this one to include a different tag on it
process/collector, but have not yet figured out how. Any thoughts ?

label                            : String label, ie. as result of
pre_tag_map evaluation


Thank you again.

On Mon, Apr 13, 2020 at 9:07 AM Paolo Lucente <pa...@pmacct.net> wrote:

>
> Hi Emanuel,
>
> I think you are looking for (i admit, non-intuitive) 'peer_src_ip'
> primitive:
>
> $ nfacctd -a | grep peer_src_ip
> peer_src_ip                      : IP address or identificator of
> telemetry exporting device
>
> Without the grep you can see all supported primitives by the nfacctd
> release you are using along with a text explanation.
>
> Paolo
>
> On Sun, Apr 12, 2020 at 06:55:26PM -0400, Emanuel dos Reis Rodrigues wrote:
> > Hello guys,
> >
> > I implemented nfacctd acting as a Netflow collector using pmacct. It is
> > working perfectly and writing the flows to a Kafka topic which I have an
> > application processing it.
> >
> > Following is my configuration:
> >
> > kafka_topic: netflow
> > kafka_broker_host: Kafka-host
> > kafka_broker_port: 9092
> > kafka_refresh_time: 1
> > daemonize: true
> > plugins: kafka
> > pcap_interface: enp0s8
> > nfacctd_ip: 192.168.1.100
> > nfacctd_port: 9995
> > aggregate: src_host, dst_host, timestamp_start, timestamp_end, src_port,
> > dst_port, proto
> >
> > Currently, there is only one Netflow exporter sending data to this
> > demon and I would like to add another exporter. The problem is that I am
> > not finding a way to differentiate the flows coming from different
> > exporters.
> >
> > Let's say I have the exporter A currently sending data to nfacctd running
> > at port 9995 and the data is being written to Kafka topic Netflow.
> >
> > Now I want a new exporter B to start sending data to nfacctd port 9996
> which
> > will be running as a separate demon ( just because I though so, not sure
> > yet if it is a necessary approach)  and writing the data to the
> > same Netflow topic in Kafka.
> >
> > When the data comes from Kafka to my application, I cannot tell from
> > which exporter the data came from. I would need some sort of
> identification
> > in order to make this differentiation. It is important for me, because my
> > application may treat differently Netflow traffic coming from these
> > two Netflow exporters.
> >
> > Thanks in advance.
> >
> > Emanuel
>
> > _______________________________________________
> > pmacct-discussion mailing list
> > http://www.pmacct.net/#mailinglists
>
>
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
>
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to