Re: [pmacct-discussion] peer-AS calculation (plus netflow v9 sampling) questions

2009-10-28 Thread Zenon Mousmoulas
Hi, On 27 Οκτ 2009, at 11:24 ΜΜ, Paolo Lucente wrote: Just so I'm sure I understand it right: You lookup the source IP address or network (for prefix-aggregated flow records) in the BGP RIB and you then match the next-hop (among other options) against this map. Correct? Correct. RPF checks

[pmacct-discussion] peer-AS calculation (plus netflow v9 sampling) questions

2009-10-27 Thread Zenon Mousmoulas
Hi, I am exporting netflow data to nfacctd from a source configured for origin-as, so I am trying to figure out how to calculate peer src/dst AS, probably by using bgp_peer_src_as_map. Here are some questions: 1. Does bgp_peer_src_as_map apply both to src and dst AS or only the first? In

Re: [pmacct-discussion] peer-AS calculation (plus netflow v9 sampling) questions

2009-10-27 Thread Paolo Lucente
Hi Zenon, On Tue, Oct 27, 2009 at 01:16:06PM +0200, Zenon Mousmoulas wrote: 1. Does bgp_peer_src_as_map apply both to src and dst AS or only the first? In any case, I don't understand how bgp_nexthop can be used for calculating the peer src AS, since that field applies to the destination

Re: [pmacct-discussion] peer-AS calculation (plus netflow v9 sampling) questions

2009-10-27 Thread Zenon Mousmoulas
Hi Paolo, On 27 Οκτ 2009, at 2:04 ΜΜ, Paolo Lucente wrote: 1. Does bgp_peer_src_as_map apply both to src and dst AS or only the first? In any case, I don't understand how bgp_nexthop can be used for calculating the peer src AS, since that field applies to the destination recorded in the flow