Hi Richard,
On Fri, Apr 02, 2010 at 03:12:23AM -0500, Richard A Steenbergen wrote:
* Record (and aggregate on) the address of the router that exported a
flow via netflow/sflow. Basically I just want to know which router
exported the flow to me, using either the agent address if available (on
sflow, etc), or the source address of the netflow packet.
As Nitzan correctly mentioned, pre-tagging should be used for this. The
idea is you get a tag instead of the IP address of the NetFlow/sFlow
exporter. If doesn't suit, just let me know: I would see it as a good
feature request.
* Record (and aggregate on) the src/dst ifindexes that are exported via
sflow/netflow protocols. Obviously this would be paired with the router
id mentioned above to give the ifindex meaning, :)
As of 0.12.1 (which will be out in roughly a week) or the code currently
in the CVS you have the in_iface and out_iface aggregation primitives.
The legacy way (up to 0.12.0) to do it was via pre-tagging as per the
point before. Of course pre-tagging (so map ifindexes to tags) can still
be used when a stricter control (filter out un-needed stuff) is required
as part of the aggregation process.
* Record the mask that was used in a src/dst_net aggregator. I figured
out how to dynamically aggregate by the netmask value exported via
netflow/sflow (via the pmacct changelog, it doesn't seem to be in the
documentation anywhere I could find), but it doesn't record the netmask
that was used. For example, say I receive an export for a flow to
[ ... ]
As of 0.12.1 (which will be out in roughly a week) or the code currently
in the CVS you have the src_mask and dst_mask aggregation primitives :-)
You have also a set of [ nfacctd_net | sfacctd_net | pmacctd_net ] config
directives which have as values [ netflow | sflow | mask | file | bgp ].
It means the network prefix and the netmask can be explicitely grasped out
of: netflow, sflow, bgp, a networks_file: a file where some networks are
listed (can be also a dump of the full BGP table) which makes sense going
libpcap or ULOG really or a static netwosk_mask directive: ie. aggregate
everything to /24: it makes sense once again if going libpcap or ULOG.
Cheers,
Paolo
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
