Hi Jerome, >From what i grasp of your sFlow frames it appears the traffic is VLAN tagged so you should use the following filter instead:
aggregate_filter[ipv4]: vlan and ip However in your email you suggest you want to do a pure L2 kind of accounting: if this is the case i advice you to download the code in the CVS since it supports a new aggregation primitive: 'etype' the Ethernet Type - which turns useful in IPv4 vs IPv6 kind of statistics. This way you would end up with a simplified configuration like, ie.: ... plugins: memory aggregate: src_mac, dst_mac, etype ... sfacctd_ip: <hidden> sfacctd_port: 6343 sfacctd_renormalize: true ... The implementation of the 'etype' aggregation primitive was done thanks to the support of Chunsing Kerk (SGIX) who also helped with testing it under NetFlow v9. In case you find it matching your needs, it would be great if you can confirm it working with sFlow. Cheers, Paolo On Wed, Feb 29, 2012 at 04:34:18PM +0100, J?r?me Fleury wrote: > I also need to IPv4/IPv6 classification and tried your method. Here is > my config: > > daemonize: true > pidfile: /var/run/sfacctd.pid > syslog: daemon > ! > aggregate[ipv4]: none > imt_path[ipv4]: /tmp/ipv4.pipe > aggregate_filter[ipv4]: ip > sfacctd_ip: <hidden> > sfacctd_port: 6343 > sfacctd_renormalize: true > ! > ! storage methods > plugins: memory[ipv4] > > > Problem is everything gets filtered, counters are empty. If I remove > aggregate_filter, counters work. > All other aggregation methods work (src_mac, dts_mac, etc), but using > aggregate_filter to filter ip protocol does not. > > Any idea anyone ? > > Here is a sample SFlow packet: > > > No. Time Source Destination > Protocol Length Info > 1 0.000000 10.120.0.251 10.120.0.161 sFlow > 1246 V5, agent 10.200.1.12, sub-agent ID 4, seq 5068874, 6 samples > > Frame 1: 1246 bytes on wire (9968 bits), 1246 bytes captured (9968 bits) > Ethernet II, Src: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00), Dst: > DigitalE_75:99:38 (aa:00:00:75:99:38) > Destination: DigitalE_75:99:38 (aa:00:00:75:99:38) > Source: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00) > Type: IP (0x0800) > Internet Protocol Version 4, Src: 10.120.0.251 (10.120.0.251), Dst: > 10.120.0.161 (10.120.0.161) > User Datagram Protocol, Src Port: ddi-udp-1 (8888), Dst Port: sflow (6343) > InMon sFlow > Datagram version: 5 > Agent address: 10.200.1.12 (10.200.1.12) > Sub-agent ID: 4 > Sequence number: 5068874 > SysUptime: 2304446650 > NumSamples: 6 > Flow sample, seq 24773749 > Enterprise: standard sFlow (0) > sFlow sample type: Flow sample (1) > Sample length (byte): 184 > Sequence number: 24773749 > Source ID class: 0 index: 199 > Sampling rate: 1 out of 8192 packets > Sample pool: 1083088896 total packets > Dropped packets: 1 > Input interface: ifIndex 199 > Output interface: ifIndex 136 > Flow record: 3 > Raw packet header > Enterprise: standard sFlow (0) > Format: Raw packet header (1) > Flow data length (byte): 84 > Header protocol: Ethernet (1) > Frame Length: 70 bytes > Payload removed: 4 bytes > Header of sampled packet: > 0012f23b6ab3001b5374697c0800450000348cbd40003906... > Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), > Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) > Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) > Source: Cisco_74:69:7c (00:1b:53:74:69:7c) > Type: IP (0x0800) > Trailer: 0101 > Internet Protocol Version 4, Src: 138.102.77.171 > (138.102.77.171), Dst: 95.140.238.31 (95.140.238.31) > Transmission Control Protocol, Src Port: 35723 > (35723), Dst Port: macromedia-fcs (1935), Seq: 1292250320, Ack: > 2432302115 > Extended switch data > Enterprise: standard sFlow (0) > Format: Extended switch data (1001) > Flow data length (byte): 16 > Incoming 802.1Q VLAN: 4 > Incoming 802.1p priority: 0 > Outgoing 802.1Q VLAN: 0 > Outgoing 802.1p priority: 0 > Extended MPLS VC data > Enterprise: standard sFlow (0) > Format: Extended MPLS VC data (1009) > Flow data length (byte): 28 > VC Instance Name Length: 14 bytes > VC Instance Name: FRANCE_IX_PROD > VLL/VC ID: 20000 > VC Label COS Value: 0 > Flow sample, seq 24773750 > Enterprise: standard sFlow (0) > sFlow sample type: Flow sample (1) > Sample length (byte): 172 > Sequence number: 24773750 > Source ID class: 0 index: 199 > Sampling rate: 1 out of 8192 packets > Sample pool: 1083097088 total packets > Dropped packets: 2 > Input interface: ifIndex 199 > Output interface: ifIndex 136 > Flow record: 3 > Raw packet header > Enterprise: standard sFlow (0) > Format: Raw packet header (1) > Flow data length (byte): 72 > Header protocol: Ethernet (1) > Frame Length: 58 bytes > Payload removed: 4 bytes > Header of sampled packet: > 0012f23b6ab3001b5374697c08004500002876c340007706... > Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), > Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) > Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) > Source: Cisco_74:69:7c (00:1b:53:74:69:7c) > Type: IP (0x0800) > Trailer: c53e > Internet Protocol Version 4, Src: 193.49.162.19 > (193.49.162.19), Dst: 87.248.221.27 (87.248.221.27) > Transmission Control Protocol, Src Port: 29707 > (29707), Dst Port: https (443), Seq: 2702398055, Ack: 29921351 > Extended switch data > Enterprise: standard sFlow (0) > Format: Extended switch data (1001) > Flow data length (byte): 16 > Incoming 802.1Q VLAN: 4 > Incoming 802.1p priority: 0 > Outgoing 802.1Q VLAN: 0 > Outgoing 802.1p priority: 0 > Extended MPLS VC data > Enterprise: standard sFlow (0) > Format: Extended MPLS VC data (1009) > Flow data length (byte): 28 > VC Instance Name Length: 14 bytes > VC Instance Name: FRANCE_IX_PROD > VLL/VC ID: 20000 > VC Label COS Value: 0 > Flow sample, seq 24773751 > Enterprise: standard sFlow (0) > sFlow sample type: Flow sample (1) > Sample length (byte): 172 > Sequence number: 24773751 > Source ID class: 0 index: 199 > Sampling rate: 1 out of 8192 packets > Sample pool: 1083105280 total packets > Dropped packets: 1 > Input interface: ifIndex 199 > Output interface: ifIndex 388 > Flow record: 3 > Raw packet header > Enterprise: standard sFlow (0) > Format: Raw packet header (1) > Flow data length (byte): 72 > Header protocol: Ethernet (1) > Frame Length: 58 bytes > Payload removed: 4 bytes > Header of sampled packet: > 001f12b7ec84001b5374697c080045000028bcd940007606... > Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), > Dst: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84) > Destination: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84) > Source: Cisco_74:69:7c (00:1b:53:74:69:7c) > Type: IP (0x0800) > Trailer: 0090 > Internet Protocol Version 4, Src: 194.199.34.163 > (194.199.34.163), Dst: 194.190.77.154 (194.190.77.154) > Transmission Control Protocol, Src Port: tunstall-pnc > (1846), Dst Port: macromedia-fcs (1935), Seq: 2439192598, Ack: > 1870757431 > Extended switch data > Enterprise: standard sFlow (0) > Format: Extended switch data (1001) > Flow data length (byte): 16 > Incoming 802.1Q VLAN: 4 > Incoming 802.1p priority: 0 > Outgoing 802.1Q VLAN: 0 > Outgoing 802.1p priority: 0 > Extended MPLS VC data > Enterprise: standard sFlow (0) > Format: Extended MPLS VC data (1009) > Flow data length (byte): 28 > VC Instance Name Length: 14 bytes > VC Instance Name: FRANCE_IX_PROD > VLL/VC ID: 20000 > VC Label COS Value: 0 > Flow sample, seq 24773752 > Enterprise: standard sFlow (0) > sFlow sample type: Flow sample (1) > Sample length (byte): 184 > Sequence number: 24773752 > Source ID class: 0 index: 199 > Sampling rate: 1 out of 8192 packets > Sample pool: 1083113472 total packets > Dropped packets: 2 > Input interface: ifIndex 199 > Output interface: ifIndex 132 > Flow record: 3 > Raw packet header > Enterprise: standard sFlow (0) > Format: Raw packet header (1) > Flow data length (byte): 84 > Header protocol: Ethernet (1) > Frame Length: 70 bytes > Payload removed: 4 bytes > Header of sampled packet: > 5c5eab043601001b5374697c080045000034da6340003c06... > Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), > Dst: JuniperN_04:36:01 (5c:5e:ab:04:36:01) > Destination: JuniperN_04:36:01 (5c:5e:ab:04:36:01) > Source: Cisco_74:69:7c (00:1b:53:74:69:7c) > Type: IP (0x0800) > Trailer: 5052 > Internet Protocol Version 4, Src: 195.83.155.53 > (195.83.155.53), Dst: 95.211.153.200 (95.211.153.200) > Transmission Control Protocol, Src Port: 44684 > (44684), Dst Port: http (80), Seq: 2654133139, Ack: 2910334516 > Extended switch data > Enterprise: standard sFlow (0) > Format: Extended switch data (1001) > Flow data length (byte): 16 > Incoming 802.1Q VLAN: 4 > Incoming 802.1p priority: 0 > Outgoing 802.1Q VLAN: 0 > Outgoing 802.1p priority: 0 > Extended MPLS VC data > Enterprise: standard sFlow (0) > Format: Extended MPLS VC data (1009) > Flow data length (byte): 28 > VC Instance Name Length: 14 bytes > VC Instance Name: FRANCE_IX_PROD > VLL/VC ID: 20000 > VC Label COS Value: 0 > Flow sample, seq 24773753 > Enterprise: standard sFlow (0) > sFlow sample type: Flow sample (1) > Sample length (byte): 184 > Sequence number: 24773753 > Source ID class: 0 index: 199 > Sampling rate: 1 out of 8192 packets > Sample pool: 1083121664 total packets > Dropped packets: 1 > Input interface: ifIndex 199 > Output interface: ifIndex 386 > Flow record: 3 > Raw packet header > Enterprise: standard sFlow (0) > Format: Raw packet header (1) > Flow data length (byte): 84 > Header protocol: Ethernet (1) > Frame Length: 70 bytes > Payload removed: 4 bytes > Header of sampled packet: > 000cdbf50200001b5374697c080045000034c35200003b06... > Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), > Dst: BrocadeC_f5:02:00 (00:0c:db:f5:02:00) > Destination: BrocadeC_f5:02:00 (00:0c:db:f5:02:00) > Source: Cisco_74:69:7c (00:1b:53:74:69:7c) > Type: IP (0x0800) > Trailer: 0000 > Internet Protocol Version 4, Src: 193.49.124.107 > (193.49.124.107), Dst: 195.8.214.48 (195.8.214.48) > Transmission Control Protocol, Src Port: 32981 > (32981), Dst Port: http (80), Seq: 3330351549, Ack: 3890980799 > Extended switch data > Enterprise: standard sFlow (0) > Format: Extended switch data (1001) > Flow data length (byte): 16 > Incoming 802.1Q VLAN: 4 > Incoming 802.1p priority: 0 > Outgoing 802.1Q VLAN: 0 > Outgoing 802.1p priority: 0 > Extended MPLS VC data > Enterprise: standard sFlow (0) > Format: Extended MPLS VC data (1009) > Flow data length (byte): 28 > VC Instance Name Length: 14 bytes > VC Instance Name: FRANCE_IX_PROD > VLL/VC ID: 20000 > VC Label COS Value: 0 > Flow sample, seq 24773754 > Enterprise: standard sFlow (0) > sFlow sample type: Flow sample (1) > Sample length (byte): 232 > Sequence number: 24773754 > Source ID class: 0 index: 199 > Sampling rate: 1 out of 8192 packets > Sample pool: 1083129856 total packets > Dropped packets: 1 > Input interface: ifIndex 199 > Output interface: ifIndex 193 > Flow record: 4 > Raw packet header > Enterprise: standard sFlow (0) > Format: Raw packet header (1) > Flow data length (byte): 84 > Header protocol: Ethernet (1) > Frame Length: 70 bytes > Payload removed: 4 bytes > Header of sampled packet: > 000cdbff0f00001b5374697c08004500003437b140003906... > Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), > Dst: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00) > Destination: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00) > Source: Cisco_74:69:7c (00:1b:53:74:69:7c) > Type: IP (0x0800) > Trailer: 0000 > Internet Protocol Version 4, Src: 193.50.95.245 > (193.50.95.245), Dst: 69.46.69.171 (69.46.69.171) > Transmission Control Protocol, Src Port: openmail > (5729), Dst Port: http (80), Seq: 655905127, Ack: 2208916754 > Extended switch data > Enterprise: standard sFlow (0) > Format: Extended switch data (1001) > Flow data length (byte): 16 > Incoming 802.1Q VLAN: 4 > Incoming 802.1p priority: 0 > Outgoing 802.1Q VLAN: 1 > Outgoing 802.1p priority: 0 > Extended MPLS VC data > Enterprise: standard sFlow (0) > Format: Extended MPLS VC data (1009) > Flow data length (byte): 28 > VC Instance Name Length: 14 bytes > VC Instance Name: FRANCE_IX_PROD > VLL/VC ID: 20000 > VC Label COS Value: 0 > Extended MPLS tunnel data > Enterprise: standard sFlow (0) > Format: Extended MPLS tunnel data (1008) > Flow data length (byte): 40 > Tunnel Name Length: 25 bytes > Tunnel Name: es2.th2_es2.itx5_via_itx5 > Tunnel ID: 0 > Tunnel COS Value: 0 > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
