Additionally, pmacct doesn't seem to really work in FreeBSD -- as far as
the latest versions go.
Their use of 'return' (with no args) on functions that are meant to
return an int flat out makes it unable to compile on FreeBSD.
If you fix those by hand, it compiles, but just seems to segfault -- I
didn't get the time to look into it further with GDB.
There's another option that claims to be able to do the same thing
(introduce BGP accounting data to normal flows - ntop's nprobe
(www.ntop.org/products/nprobe/), but it's not free. I don't know if it
works in FreeBSD well either.)
As to the ng_netflow hook, +1, excellent idea.
On 4/2/2015 午前 03:08, Nikolay Denev wrote:
On Wed, Apr 1, 2015 at 12:50 PM, William Waites <wwai...@tardis.ed.ac.uk>
wrote:
I run a small network composed of even smaller networks each
encapsulated in an autonomous system. I'd like to do traffic
accounting using netflow aggregated by ASN. My border routers run
FreeBSD and BIRD.
Right now, and this is mentioned in ng_netflow(4), we do not fill in
the source and destination ASN because there is no information to get
this from the routing daemon's RIB. Probably if we come up with such a
way it should be generic so it could be used by Quagga, BIRD or
OpenBGPD.
I've done a little bit of thinking about how this could be done, and
come up with two main strategies:
1. A new kind of netgraph node inserted before ng_netflow knows how
to query the routing daemon and decorates the packet with the
result, which ng_netflow then puts into the flow packet if
present. This entails either a copy (tee) or putting the lookup
in the data path which may be suboptimal.
2. A new hook added to the ng_netflow node that allows it to query
the routing daemon through a different new kind of netgraph
node. This is probably better but may be slightly more
complicated to implement.
Is anyone working on this or has given this though? I wasn't able to
find much by searching the list archives. It may be that I will soon
have some students that I can set on this task but would not like to
unnecessarily duplicate effort.
Cheers,
-w
--
William Waites <wwai...@tardis.ed.ac.uk> | School of Informatics
http://tardis.ed.ac.uk/~wwaites/ | University of Edinburgh
http://www.hubs.net.uk/ | HUBS AS60241
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.
Hi,
It's not ng_netflow, but if you need this today you can take a look at
http://www.pmacct.net ? (there is a package/port too).
It comes with BGP daemon (stripped down quagga) and can export this data.
--Nikolay
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
