Re: [pmacct-discussion] raw data - question

[Sven Anderson]

Hi all,

Paolo Lucente, 10.07.2006 19:31:
 No, you cannot access data in raw format; you need to modify source code.
 There is an outated patch around for the - indeed, outdated - 0.7.9 version
 of pmacct: it was basically allowing to get src/dst IP addresses as decimals
 in a MySQL table. 

What about including an option to switch to numeric-only? I can try to
write it.

BTW.: do you have plans already for a flexible table structure, which is
needed for full Netflow v9/IPFIX template support? As this will become
more complicated, than the fixed tables used at the moment, I see this
also as an argument for an data-access API, which I proposed in the other
mail.


Cheers,

Sven

-- 
Sven Anderson
Institute for Informatics - http://www.ifi.informatik.uni-goettingen.de
Georg-August-Universitaet Goettingen
Lotzestr. 16-18, 37083 Goettingen, Germany

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] raw data - question

[Paolo Lucente]

Hello Dian,
thank you very much for the WC greetings, hehe! 

On Mon, Jul 10, 2006 at 11:28:57AM +0200, Dian Baltadzhiev wrote:
 now, my question: is there an option, so that i can configure nfacctd to 
 send src and dst addresses in raw format, i mean as a decimal number and not 
 in dotted format. or should i change the source code?

No, you cannot access data in raw format; you need to modify source code.
There is an outated patch around for the - indeed, outdated - 0.7.9 version
of pmacct: it was basically allowing to get src/dst IP addresses as decimals
in a MySQL table. 

Cheers,
Paolo

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] raw data - question

[Dian Baltadzhiev]

hi all!
thank you for the fast reply! i think i found the decision, and i think that 
a configuration option would be appreciated( like #ifdef RAWFORMATEDIP). but 
..you can just patch the source code (as of 0.10.2) in print_pugin.c, line 
435:
instead of
printf(%-15s , src_host);

you write

printf(%-15u , ntohl(data-src_ip.address.ipv4.s_addr));

and then the same step for the dst_host. the unused value of src_host could 
be left unset (just comment - //printf(%-45s , src_host);) and do not 
forget to change the lines for ipv6 (i left them unchanged since i use only 
ipv4).

greetings,

dian



- Original Message - 
From: [EMAIL PROTECTED]
To: pmacct-discussion@pmacct.net
Sent: Monday, July 10, 2006 7:31 PM
Subject: pmacct-discussion Digest, Vol 21, Issue 2


 Send pmacct-discussion mailing list submissions to
 pmacct-discussion@pmacct.net

 To subscribe or unsubscribe via the World Wide Web, visit
 http://www.pmacct.net/mailman/listinfo/pmacct-discussion
 or, via email, send a message with subject or body 'help' to
 [EMAIL PROTECTED]

 You can reach the person managing the list at
 [EMAIL PROTECTED]

 When replying, please edit your Subject line so it is more specific
 than Re: Contents of pmacct-discussion digest...






 Today's Topics:

   1. Re: pmacctd - netflow/sflow export (Paolo Lucente)
   2. Re: pmacctd - netflow/sflow export (Ivan A. Beveridge)
   3. Re: pmacctd - netflow/sflow export (Ivan A. Beveridge)
   4. Re: sfacctd/nfacctd security (Peter Nixon)
   5. Re: pmacctd - netflow/sflow export (Peter Nixon)
   6. Re: pmacct does not show much information/Help with
  configuration needed (Melitta Dragaschnig)
   7. configuration help (Dian Baltadzhiev)
   8. Re: configuration help (Ivan A. Beveridge)
   9. raw data - question (Dian Baltadzhiev)
  10. Re: raw data - question (Paolo Lucente)






 ___
 pmacct-discussion mailing list
 http://www.pmacct.net/#mailinglists
 


___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists