In theory yes - you can separate the data back based on exporter IP and
exporter ID. But as far as I know exporter IP is not saved by default in
the nfcapd file and you need to instruct nfcapd to save it. You should
change your nfsen.conf file to something like:
'Device' => { 'port' => 'x', 'col' => 'x, 'type' => 'netflow', 'optarg'
=> ' -T +13,+14' },
>From nfcapd's man page:
13 Exporting router IPv4/IPv6 address
14 Exporting router ID
>From nfdump you would need to add extra fields to your view to be able to
view the new data:
%exp Exporter ID
%ra Router IP Address
See man nfdump for details.
On Mon, Dec 1, 2014 at 4:12 PM, Juan Quintanilla <[email protected]
> wrote:
> Hi list,
>
>
>
> While NfSen distinguishes sources based on port as defined in nfsen.conf
> file…
>
> 'Device' => { 'port' => 'x', 'col' => 'x, 'type' => 'netflow' },
>
>
>
> Question: Is it possible to send netflow data from different devices using
> the same port and have NfSen splitting them in different channels as per
> the source IP info contained in the flow?
>
> If the answer is yes, I would greatly appreciate if someone could share
> with me the way you have achieved this.
>
>
>
> Many thanks in advance for your help & support.
>
>
>
> Regards/Saludos,
>
>
>
> Juan Quintanilla
>
> Operations Security Engineer
>
> GEANT Limited
>
>
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
>
------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
