Re: [Nfsen-discuss] egress traffic

Lambert Hoogeveen Wed, 16 Apr 2008 01:52:23 -0700

Hi Alban,
There's a website "http://asn.cymru.com/cgi-bin/whois.cgi" that looks up AS numbers for given IP addresses.
Obviously this is just for one-off queries, but perhaps you can contact them if they can provide the script or more advanced tools.
Hope this is of (some) help.

Lambert

Alban Dani wrote:

Peter, thank you.

I figured that out after looking at the routing tables too.

I am in a bit of a bind right now because many of the routers do not have the capacity to get the full routing table
and on the other hand I really need these AS number.
Is there any tool (ie script) that would work in conjunction with nfdump to get the AS number based on the ip addresses.
and then feed the data back in?

thank you again,

Alban

On Mon, Apr 14, 2008 at 3:23 AM, Peter Haag <[EMAIL PROTECTED]> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --On April 10, 2008 18:44:26 -0400 Alban Dani <[EMAIL PROTECTED]> wrote:

| I have a router that connects to two ISP providers and am interested only in
| the traffic going out to them
|
| I configured "ip flow egress" on the two physical interfaces connected to
| them.
| No flow related config in any other interface.
|
| otherwise the rest of the config is:
|
| mls netflow interface
| mls flow ip interface-full
| no mls flow ipv6
| mls nde sender version 5
| mls sampling packet-based 4096 16000
|
|
| Nfsen is still reporting a lot of flows with Dst AS 0.
|
| This is a cisco ME-C6524GT-8S - Version 12.2(33)SXH1 and I have not found
| any netflow related bug for it ( so far ).

AS 0 is a question wether you have full routing and BGP information at all in the router. Apart from that, there are some IOS
version having problems with AS 0 but not sure which versions ..

- Peter

|
| thank you,
|
| Alban

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iQCVAwUBSAMGY/5AbZRALNr/AQLirwP/WWqUVTVQqDRenRC+axyHjpJzM2sBC+q0
lLbWKGHY0Wi69aStabJv+MgVnhpHhEJHvZF58FLscsb+2wJrslXVg/4jQgkFW8S0
gbjWNCKrSrOZ/TyK2qb/2vWwsVT8v/9sfzcOzo9AQVDlKMAZZpOIzwdNP1mEPSLK
lFKmRFMf9w0=
=QNGP
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
  

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss

Re: [Nfsen-discuss] egress traffic

Reply via email to