I also need to IPv4/IPv6 classification and tried your method. Here is my config:
daemonize: true pidfile: /var/run/sfacctd.pid syslog: daemon ! aggregate[ipv4]: none imt_path[ipv4]: /tmp/ipv4.pipe aggregate_filter[ipv4]: ip sfacctd_ip: <hidden> sfacctd_port: 6343 sfacctd_renormalize: true ! ! storage methods plugins: memory[ipv4] Problem is everything gets filtered, counters are empty. If I remove aggregate_filter, counters work. All other aggregation methods work (src_mac, dts_mac, etc), but using aggregate_filter to filter ip protocol does not. Any idea anyone ? Here is a sample SFlow packet: No. Time Source Destination Protocol Length Info 1 0.000000 10.120.0.251 10.120.0.161 sFlow 1246 V5, agent 10.200.1.12, sub-agent ID 4, seq 5068874, 6 samples Frame 1: 1246 bytes on wire (9968 bits), 1246 bytes captured (9968 bits) Ethernet II, Src: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00), Dst: DigitalE_75:99:38 (aa:00:00:75:99:38) Destination: DigitalE_75:99:38 (aa:00:00:75:99:38) Source: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.120.0.251 (10.120.0.251), Dst: 10.120.0.161 (10.120.0.161) User Datagram Protocol, Src Port: ddi-udp-1 (8888), Dst Port: sflow (6343) InMon sFlow Datagram version: 5 Agent address: 10.200.1.12 (10.200.1.12) Sub-agent ID: 4 Sequence number: 5068874 SysUptime: 2304446650 NumSamples: 6 Flow sample, seq 24773749 Enterprise: standard sFlow (0) sFlow sample type: Flow sample (1) Sample length (byte): 184 Sequence number: 24773749 Source ID class: 0 index: 199 Sampling rate: 1 out of 8192 packets Sample pool: 1083088896 total packets Dropped packets: 1 Input interface: ifIndex 199 Output interface: ifIndex 136 Flow record: 3 Raw packet header Enterprise: standard sFlow (0) Format: Raw packet header (1) Flow data length (byte): 84 Header protocol: Ethernet (1) Frame Length: 70 bytes Payload removed: 4 bytes Header of sampled packet: 0012f23b6ab3001b5374697c0800450000348cbd40003906... Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) Source: Cisco_74:69:7c (00:1b:53:74:69:7c) Type: IP (0x0800) Trailer: 0101 Internet Protocol Version 4, Src: 138.102.77.171 (138.102.77.171), Dst: 95.140.238.31 (95.140.238.31) Transmission Control Protocol, Src Port: 35723 (35723), Dst Port: macromedia-fcs (1935), Seq: 1292250320, Ack: 2432302115 Extended switch data Enterprise: standard sFlow (0) Format: Extended switch data (1001) Flow data length (byte): 16 Incoming 802.1Q VLAN: 4 Incoming 802.1p priority: 0 Outgoing 802.1Q VLAN: 0 Outgoing 802.1p priority: 0 Extended MPLS VC data Enterprise: standard sFlow (0) Format: Extended MPLS VC data (1009) Flow data length (byte): 28 VC Instance Name Length: 14 bytes VC Instance Name: FRANCE_IX_PROD VLL/VC ID: 20000 VC Label COS Value: 0 Flow sample, seq 24773750 Enterprise: standard sFlow (0) sFlow sample type: Flow sample (1) Sample length (byte): 172 Sequence number: 24773750 Source ID class: 0 index: 199 Sampling rate: 1 out of 8192 packets Sample pool: 1083097088 total packets Dropped packets: 2 Input interface: ifIndex 199 Output interface: ifIndex 136 Flow record: 3 Raw packet header Enterprise: standard sFlow (0) Format: Raw packet header (1) Flow data length (byte): 72 Header protocol: Ethernet (1) Frame Length: 58 bytes Payload removed: 4 bytes Header of sampled packet: 0012f23b6ab3001b5374697c08004500002876c340007706... Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) Source: Cisco_74:69:7c (00:1b:53:74:69:7c) Type: IP (0x0800) Trailer: c53e Internet Protocol Version 4, Src: 193.49.162.19 (193.49.162.19), Dst: 87.248.221.27 (87.248.221.27) Transmission Control Protocol, Src Port: 29707 (29707), Dst Port: https (443), Seq: 2702398055, Ack: 29921351 Extended switch data Enterprise: standard sFlow (0) Format: Extended switch data (1001) Flow data length (byte): 16 Incoming 802.1Q VLAN: 4 Incoming 802.1p priority: 0 Outgoing 802.1Q VLAN: 0 Outgoing 802.1p priority: 0 Extended MPLS VC data Enterprise: standard sFlow (0) Format: Extended MPLS VC data (1009) Flow data length (byte): 28 VC Instance Name Length: 14 bytes VC Instance Name: FRANCE_IX_PROD VLL/VC ID: 20000 VC Label COS Value: 0 Flow sample, seq 24773751 Enterprise: standard sFlow (0) sFlow sample type: Flow sample (1) Sample length (byte): 172 Sequence number: 24773751 Source ID class: 0 index: 199 Sampling rate: 1 out of 8192 packets Sample pool: 1083105280 total packets Dropped packets: 1 Input interface: ifIndex 199 Output interface: ifIndex 388 Flow record: 3 Raw packet header Enterprise: standard sFlow (0) Format: Raw packet header (1) Flow data length (byte): 72 Header protocol: Ethernet (1) Frame Length: 58 bytes Payload removed: 4 bytes Header of sampled packet: 001f12b7ec84001b5374697c080045000028bcd940007606... Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), Dst: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84) Destination: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84) Source: Cisco_74:69:7c (00:1b:53:74:69:7c) Type: IP (0x0800) Trailer: 0090 Internet Protocol Version 4, Src: 194.199.34.163 (194.199.34.163), Dst: 194.190.77.154 (194.190.77.154) Transmission Control Protocol, Src Port: tunstall-pnc (1846), Dst Port: macromedia-fcs (1935), Seq: 2439192598, Ack: 1870757431 Extended switch data Enterprise: standard sFlow (0) Format: Extended switch data (1001) Flow data length (byte): 16 Incoming 802.1Q VLAN: 4 Incoming 802.1p priority: 0 Outgoing 802.1Q VLAN: 0 Outgoing 802.1p priority: 0 Extended MPLS VC data Enterprise: standard sFlow (0) Format: Extended MPLS VC data (1009) Flow data length (byte): 28 VC Instance Name Length: 14 bytes VC Instance Name: FRANCE_IX_PROD VLL/VC ID: 20000 VC Label COS Value: 0 Flow sample, seq 24773752 Enterprise: standard sFlow (0) sFlow sample type: Flow sample (1) Sample length (byte): 184 Sequence number: 24773752 Source ID class: 0 index: 199 Sampling rate: 1 out of 8192 packets Sample pool: 1083113472 total packets Dropped packets: 2 Input interface: ifIndex 199 Output interface: ifIndex 132 Flow record: 3 Raw packet header Enterprise: standard sFlow (0) Format: Raw packet header (1) Flow data length (byte): 84 Header protocol: Ethernet (1) Frame Length: 70 bytes Payload removed: 4 bytes Header of sampled packet: 5c5eab043601001b5374697c080045000034da6340003c06... Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), Dst: JuniperN_04:36:01 (5c:5e:ab:04:36:01) Destination: JuniperN_04:36:01 (5c:5e:ab:04:36:01) Source: Cisco_74:69:7c (00:1b:53:74:69:7c) Type: IP (0x0800) Trailer: 5052 Internet Protocol Version 4, Src: 195.83.155.53 (195.83.155.53), Dst: 95.211.153.200 (95.211.153.200) Transmission Control Protocol, Src Port: 44684 (44684), Dst Port: http (80), Seq: 2654133139, Ack: 2910334516 Extended switch data Enterprise: standard sFlow (0) Format: Extended switch data (1001) Flow data length (byte): 16 Incoming 802.1Q VLAN: 4 Incoming 802.1p priority: 0 Outgoing 802.1Q VLAN: 0 Outgoing 802.1p priority: 0 Extended MPLS VC data Enterprise: standard sFlow (0) Format: Extended MPLS VC data (1009) Flow data length (byte): 28 VC Instance Name Length: 14 bytes VC Instance Name: FRANCE_IX_PROD VLL/VC ID: 20000 VC Label COS Value: 0 Flow sample, seq 24773753 Enterprise: standard sFlow (0) sFlow sample type: Flow sample (1) Sample length (byte): 184 Sequence number: 24773753 Source ID class: 0 index: 199 Sampling rate: 1 out of 8192 packets Sample pool: 1083121664 total packets Dropped packets: 1 Input interface: ifIndex 199 Output interface: ifIndex 386 Flow record: 3 Raw packet header Enterprise: standard sFlow (0) Format: Raw packet header (1) Flow data length (byte): 84 Header protocol: Ethernet (1) Frame Length: 70 bytes Payload removed: 4 bytes Header of sampled packet: 000cdbf50200001b5374697c080045000034c35200003b06... Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), Dst: BrocadeC_f5:02:00 (00:0c:db:f5:02:00) Destination: BrocadeC_f5:02:00 (00:0c:db:f5:02:00) Source: Cisco_74:69:7c (00:1b:53:74:69:7c) Type: IP (0x0800) Trailer: 0000 Internet Protocol Version 4, Src: 193.49.124.107 (193.49.124.107), Dst: 195.8.214.48 (195.8.214.48) Transmission Control Protocol, Src Port: 32981 (32981), Dst Port: http (80), Seq: 3330351549, Ack: 3890980799 Extended switch data Enterprise: standard sFlow (0) Format: Extended switch data (1001) Flow data length (byte): 16 Incoming 802.1Q VLAN: 4 Incoming 802.1p priority: 0 Outgoing 802.1Q VLAN: 0 Outgoing 802.1p priority: 0 Extended MPLS VC data Enterprise: standard sFlow (0) Format: Extended MPLS VC data (1009) Flow data length (byte): 28 VC Instance Name Length: 14 bytes VC Instance Name: FRANCE_IX_PROD VLL/VC ID: 20000 VC Label COS Value: 0 Flow sample, seq 24773754 Enterprise: standard sFlow (0) sFlow sample type: Flow sample (1) Sample length (byte): 232 Sequence number: 24773754 Source ID class: 0 index: 199 Sampling rate: 1 out of 8192 packets Sample pool: 1083129856 total packets Dropped packets: 1 Input interface: ifIndex 199 Output interface: ifIndex 193 Flow record: 4 Raw packet header Enterprise: standard sFlow (0) Format: Raw packet header (1) Flow data length (byte): 84 Header protocol: Ethernet (1) Frame Length: 70 bytes Payload removed: 4 bytes Header of sampled packet: 000cdbff0f00001b5374697c08004500003437b140003906... Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), Dst: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00) Destination: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00) Source: Cisco_74:69:7c (00:1b:53:74:69:7c) Type: IP (0x0800) Trailer: 0000 Internet Protocol Version 4, Src: 193.50.95.245 (193.50.95.245), Dst: 69.46.69.171 (69.46.69.171) Transmission Control Protocol, Src Port: openmail (5729), Dst Port: http (80), Seq: 655905127, Ack: 2208916754 Extended switch data Enterprise: standard sFlow (0) Format: Extended switch data (1001) Flow data length (byte): 16 Incoming 802.1Q VLAN: 4 Incoming 802.1p priority: 0 Outgoing 802.1Q VLAN: 1 Outgoing 802.1p priority: 0 Extended MPLS VC data Enterprise: standard sFlow (0) Format: Extended MPLS VC data (1009) Flow data length (byte): 28 VC Instance Name Length: 14 bytes VC Instance Name: FRANCE_IX_PROD VLL/VC ID: 20000 VC Label COS Value: 0 Extended MPLS tunnel data Enterprise: standard sFlow (0) Format: Extended MPLS tunnel data (1008) Flow data length (byte): 40 Tunnel Name Length: 25 bytes Tunnel Name: es2.th2_es2.itx5_via_itx5 Tunnel ID: 0 Tunnel COS Value: 0 _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists