Re: [pmacct-discussion] Packet inspection with pmacct?

[Paolo Lucente]

Hi Bryan,

More than a plugin, i may recommend looking at the custom primitives
framework, ie. aggregate_primitives config directive. For pmacctd it
contemplates offsets to L2, L3 and L4. You may want/need to extend
the to do the same with L7 - with peculiarities of L7, ie. not just
relying on offsets. If this sounds of interest, i propose to reconvene
1:1 to see what would be a sensible way forward.

Cheers,
Paolo 

On Wed, Oct 26, 2016 at 09:36:54PM +, Bryan Cantwell wrote:
> I've just begun looking at pmacct and I wonder if there is already a plugin 
> that allows for more of a deep packet inspection so that I could pull out 
> URLs and other information that is available in  http traffic I am seeing?
> 
> 
> [FireScope]
> 
> Bryan Cantwell | SVP Technology
> 
> www.firescope.com | Office: 214.296.9243 x452 | 
> Mobile: 214.683.9646

> ___
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists


___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

[pmacct-discussion] Packet inspection with pmacct?

[Bryan Cantwell]

I've just begun looking at pmacct and I wonder if there is already a plugin 
that allows for more of a deep packet inspection so that I could pull out URLs 
and other information that is available in  http traffic I am seeing?


[FireScope]

Bryan Cantwell | SVP Technology

www.firescope.com | Office: 214.296.9243 x452 | 
Mobile: 214.683.9646
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists