Hi,

I’m using sfacctd, and nfacctd to collect/digest flows, but I’m having two 
issues with IPFIX 315 being exported by Cisco NCSs on my lab environment.

=======================================================================================================================
1. The router is sending sampling rate template, but nfacctd is unable to 
detect it:
Cisco NetFlow/IPFIX
    Version: 10
    Length: 140
    Timestamp: Jul 27, 2023 21:23:32.000000000 CEST
        ExportTime: 1690485812
    FlowSequence: 4603756
    Observation Domain Id: 4096
    Set 1 [id=257] (1 flows)
        FlowSet Id: (Data) (257)
        FlowSet Length: 124
        [Template Frame: 3]
        Flow 1
            Selector Id: 1
            Sampling Packet Interval: 32000
            Selector Algorithm: Random n-out-of-N Sampling (3)
            Sampling Size: 1
            Sampling Population: 32000
            SamplerName: ipfix_sm
            Selector Name: ipfix_sm
                String_len_short: 8
        Padding: 000000

Seems that nfacctd understand the template:

DEBUG ( default/core ): Received NetFlow/IPFIX packet from 
[192.168.245.145:21660] version [10] seqno [4621414]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [3] from 
[192.168.245.145:21660] seqno [4621414]
DEBUG ( default/core ): NfV10 agent         : 192.168.245.145:4096
DEBUG ( default/core ): NfV10 template type : options
DEBUG ( default/core ): NfV10 template ID   : 338
DEBUG ( default/core ): 
-------------------------------------------------------------
DEBUG ( default/core ): |    pen     |         field type         | offset |  
size  |
DEBUG ( default/core ): | 0          | 149                [149  ] |      0 |    
  4 |
DEBUG ( default/core ): | 0          | 160                [160  ] |      4 |    
  8 |
DEBUG ( default/core ): 
-------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 12
DEBUG ( default/core ):
DEBUG ( default/core ): Received NetFlow/IPFIX packet from 
[192.168.245.145:21660] version [10] seqno [4621414]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [338] from 
[192.168.245.145:21660] seqno [4621414]
DEBUG ( default/core ): Received NetFlow/IPFIX packet from 
[192.168.245.145:21660] version [10] seqno [4621415]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [3] from 
[192.168.245.145:21660] seqno [4621415]
DEBUG ( default/core ): NfV10 agent         : 192.168.245.145:4096
DEBUG ( default/core ): NfV10 template type : options
DEBUG ( default/core ): NfV10 template ID   : 257
DEBUG ( default/core ): 
-------------------------------------------------------------
DEBUG ( default/core ): |    pen     |         field type         | offset |  
size  |
DEBUG ( default/core ): | 0          | 302                [302  ] |      0 |    
  4 |
DEBUG ( default/core ): | 0          | 305                [305  ] |      4 |    
  4 |
DEBUG ( default/core ): | 0          | 304                [304  ] |      8 |    
  2 |
DEBUG ( default/core ): | 0          | 309                [309  ] |     10 |    
  4 |
DEBUG ( default/core ): | 0          | 310                [310  ] |     14 |    
  4 |
DEBUG ( default/core ): | 0          | sampler name       [84   ] |     18 |    
 90 |
DEBUG ( default/core ): | 0          | 335                [335  ] |    108 |  
65535 |
DEBUG ( default/core ): 
-------------------------------------------------------------
DEBUG ( default/core ): Netflow V9/IPFIX record size : 107
DEBUG ( default/core ):
DEBUG ( default/core ): Received NetFlow/IPFIX packet from 
[192.168.245.145:21660] version [10] seqno [4621415]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [257] from 
[192.168.245.145:21660] seqno [4621415]
DEBUG ( default/core ): Received NetFlow/IPFIX packet from 
[172.31.31.162:63625] version [10] seqno [2092073163]
DEBUG ( default/core ): Processing NetFlow/IPFIX flowset [335] from 
[172.31.31.162:63625] seqno [2092073163]

But when printing the data, seems that sampling_rate is not being detected:
{"event_type": "purge", "mac_src": "68:00:04:2e:0b:55", "mac_dst": 
"78:00:04:4c:5e:e7", "vlan_in": 1012, "vlan_out": 0, "etype": "800", 
"peer_ip_src": "192.168.245.145", "ip_proto": "tcp", "sampling_rate": 0, 
"stamp_inserted": "1690488600", "stamp_updated": "1690488901", "packets": 0, 
"bytes": 0}

I have configured nfacctd_renormalize to true, and the same configuration 
pattern works for sflow. Can you please help me with that? Am I missing 
something?

=======================================================================================================================
2. I have few l2transports using 2 qtags, and I do see it in the pcap:
Flow 4
    InputInt: 15
    OutputInt: 5
    Data Link Frame Size: 106
    Data Link Frame Section: 
7800044c5ee76800042e0ba6810003f4810000640800450004ce04d200007f06dc7cc612…
        Ethernet II, Src: 68:00:04:2e:0b:a6 (68:00:04:2e:0b:a6), Dst: 
78:00:04:4c:5e:e7 (78:00:04:4c:5e:e7)
        802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 1012
        802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 100
        Internet Protocol Version 4, Src: 198.18.101.91, Dst: 198.18.100.91
        Transmission Control Protocol, Src Port: 48482, Dst Port: 80, Seq: 
129018, Len: 44
        String_len_short: 106

But I’m unable to get vlan_out:
{"event_type": "purge", "mac_src": "68:00:04:2e:0b:55", "mac_dst": 
"78:00:04:4c:5e:e7", "vlan_in": 1012, "vlan_out": 0, "etype": "800", 
"peer_ip_src": "192.168.245.145", "ip_proto": "tcp", "sampling_rate": 0, 
"stamp_inserted": "1690488600", "stamp_updated": "1690488901", "packets": 0, 
"bytes": 0}

Interface config:
interface Bundle-Ether1.1012 l2transport
 encapsulation dot1q 1012 second-dot1q 100
 rewrite ingress tag pop 2 symmetric
 flow datalinkframesection monitor ipfix_mon sampler ipfix_sm ingress
!

IPFIX config:
flow exporter-map ipfix_exp
 version ipfix
  options sampler-table
  template options timeout 30
 !
 dscp 40
 transport udp 2100
 source MgmtEth0/RP0/CPU0/0
 destination 192.168.245.240
!
flow monitor-map ipfix_mon
 record datalinksectiondump
 exporter ipfix_exp
 cache immediate
 cache entries 1000000
 cache timeout rate-limit 1000000
!
sampler-map ipfix_sm
 random 1 out-of 32000

Can you please help me with that too? Also, similar setup works for sflow.

=======================================================================================================================

# nfacctd -V
NetFlow Accounting Daemon, nfacctd 1.7.8-git [20221231-1 (723b0cb2)]

Thanks in advance for any inputs.


--
(Atenciosamente|Best regards|Cordiali Saluti|Vriendelijke groeten),

Tiago Felipe Gonçalves
PGP Fingerprint - A2:82:BD:48:EE:8D:C4:99:C2:4E:81:D4:C4:7B:1C:2E:C7:F3:04:C9
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to