Guys, sounds like this feature is working like a charm!
root@sflow:~/pmacct# /opt/pmacct/bin/pmacct -s -p /tmp/etype.pipe ETYPE PACKETS BYTES 800 80199680 59918221312 86dd 81920 21331968 Thanks a lot! On Fri, Mar 2, 2012 at 03:40, Kerk Chun Sing <chunsing.k...@sgix.sg> wrote: > Hi Jerome, > > http://www.mail-archive.com/pmacct-commits@pmacct.net/msg00491.html > > Hope this helps. > > /chunsing > > Jérôme Fleury wrote: >> >> I also need to IPv4/IPv6 classification and tried your method. Here is >> my config: >> >> daemonize: true >> pidfile: /var/run/sfacctd.pid >> syslog: daemon >> ! >> aggregate[ipv4]: none >> imt_path[ipv4]: /tmp/ipv4.pipe >> aggregate_filter[ipv4]: ip >> sfacctd_ip:<hidden> >> sfacctd_port: 6343 >> sfacctd_renormalize: true >> ! >> ! storage methods >> plugins: memory[ipv4] >> >> >> Problem is everything gets filtered, counters are empty. If I remove >> aggregate_filter, counters work. >> All other aggregation methods work (src_mac, dts_mac, etc), but using >> aggregate_filter to filter ip protocol does not. >> >> Any idea anyone ? >> >> Here is a sample SFlow packet: >> >> >> No. Time Source Destination >> Protocol Length Info >> 1 0.000000 10.120.0.251 10.120.0.161 sFlow >> 1246 V5, agent 10.200.1.12, sub-agent ID 4, seq 5068874, 6 samples >> >> Frame 1: 1246 bytes on wire (9968 bits), 1246 bytes captured (9968 bits) >> Ethernet II, Src: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00), Dst: >> DigitalE_75:99:38 (aa:00:00:75:99:38) >> Destination: DigitalE_75:99:38 (aa:00:00:75:99:38) >> Source: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00) >> Type: IP (0x0800) >> Internet Protocol Version 4, Src: 10.120.0.251 (10.120.0.251), Dst: >> 10.120.0.161 (10.120.0.161) >> User Datagram Protocol, Src Port: ddi-udp-1 (8888), Dst Port: sflow (6343) >> InMon sFlow >> Datagram version: 5 >> Agent address: 10.200.1.12 (10.200.1.12) >> Sub-agent ID: 4 >> Sequence number: 5068874 >> SysUptime: 2304446650 >> NumSamples: 6 >> Flow sample, seq 24773749 >> Enterprise: standard sFlow (0) >> sFlow sample type: Flow sample (1) >> Sample length (byte): 184 >> Sequence number: 24773749 >> Source ID class: 0 index: 199 >> Sampling rate: 1 out of 8192 packets >> Sample pool: 1083088896 total packets >> Dropped packets: 1 >> Input interface: ifIndex 199 >> Output interface: ifIndex 136 >> Flow record: 3 >> Raw packet header >> Enterprise: standard sFlow (0) >> Format: Raw packet header (1) >> Flow data length (byte): 84 >> Header protocol: Ethernet (1) >> Frame Length: 70 bytes >> Payload removed: 4 bytes >> Header of sampled packet: >> 0012f23b6ab3001b5374697c0800450000348cbd40003906... >> Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), >> Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) >> Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) >> Source: Cisco_74:69:7c (00:1b:53:74:69:7c) >> Type: IP (0x0800) >> Trailer: 0101 >> Internet Protocol Version 4, Src: 138.102.77.171 >> (138.102.77.171), Dst: 95.140.238.31 (95.140.238.31) >> Transmission Control Protocol, Src Port: 35723 >> (35723), Dst Port: macromedia-fcs (1935), Seq: 1292250320, Ack: >> 2432302115 >> Extended switch data >> Enterprise: standard sFlow (0) >> Format: Extended switch data (1001) >> Flow data length (byte): 16 >> Incoming 802.1Q VLAN: 4 >> Incoming 802.1p priority: 0 >> Outgoing 802.1Q VLAN: 0 >> Outgoing 802.1p priority: 0 >> Extended MPLS VC data >> Enterprise: standard sFlow (0) >> Format: Extended MPLS VC data (1009) >> Flow data length (byte): 28 >> VC Instance Name Length: 14 bytes >> VC Instance Name: FRANCE_IX_PROD >> VLL/VC ID: 20000 >> VC Label COS Value: 0 >> Flow sample, seq 24773750 >> Enterprise: standard sFlow (0) >> sFlow sample type: Flow sample (1) >> Sample length (byte): 172 >> Sequence number: 24773750 >> Source ID class: 0 index: 199 >> Sampling rate: 1 out of 8192 packets >> Sample pool: 1083097088 total packets >> Dropped packets: 2 >> Input interface: ifIndex 199 >> Output interface: ifIndex 136 >> Flow record: 3 >> Raw packet header >> Enterprise: standard sFlow (0) >> Format: Raw packet header (1) >> Flow data length (byte): 72 >> Header protocol: Ethernet (1) >> Frame Length: 58 bytes >> Payload removed: 4 bytes >> Header of sampled packet: >> 0012f23b6ab3001b5374697c08004500002876c340007706... >> Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), >> Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) >> Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3) >> Source: Cisco_74:69:7c (00:1b:53:74:69:7c) >> Type: IP (0x0800) >> Trailer: c53e >> Internet Protocol Version 4, Src: 193.49.162.19 >> (193.49.162.19), Dst: 87.248.221.27 (87.248.221.27) >> Transmission Control Protocol, Src Port: 29707 >> (29707), Dst Port: https (443), Seq: 2702398055, Ack: 29921351 >> Extended switch data >> Enterprise: standard sFlow (0) >> Format: Extended switch data (1001) >> Flow data length (byte): 16 >> Incoming 802.1Q VLAN: 4 >> Incoming 802.1p priority: 0 >> Outgoing 802.1Q VLAN: 0 >> Outgoing 802.1p priority: 0 >> Extended MPLS VC data >> Enterprise: standard sFlow (0) >> Format: Extended MPLS VC data (1009) >> Flow data length (byte): 28 >> VC Instance Name Length: 14 bytes >> VC Instance Name: FRANCE_IX_PROD >> VLL/VC ID: 20000 >> VC Label COS Value: 0 >> Flow sample, seq 24773751 >> Enterprise: standard sFlow (0) >> sFlow sample type: Flow sample (1) >> Sample length (byte): 172 >> Sequence number: 24773751 >> Source ID class: 0 index: 199 >> Sampling rate: 1 out of 8192 packets >> Sample pool: 1083105280 total packets >> Dropped packets: 1 >> Input interface: ifIndex 199 >> Output interface: ifIndex 388 >> Flow record: 3 >> Raw packet header >> Enterprise: standard sFlow (0) >> Format: Raw packet header (1) >> Flow data length (byte): 72 >> Header protocol: Ethernet (1) >> Frame Length: 58 bytes >> Payload removed: 4 bytes >> Header of sampled packet: >> 001f12b7ec84001b5374697c080045000028bcd940007606... >> Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), >> Dst: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84) >> Destination: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84) >> Source: Cisco_74:69:7c (00:1b:53:74:69:7c) >> Type: IP (0x0800) >> Trailer: 0090 >> Internet Protocol Version 4, Src: 194.199.34.163 >> (194.199.34.163), Dst: 194.190.77.154 (194.190.77.154) >> Transmission Control Protocol, Src Port: tunstall-pnc >> (1846), Dst Port: macromedia-fcs (1935), Seq: 2439192598, Ack: >> 1870757431 >> Extended switch data >> Enterprise: standard sFlow (0) >> Format: Extended switch data (1001) >> Flow data length (byte): 16 >> Incoming 802.1Q VLAN: 4 >> Incoming 802.1p priority: 0 >> Outgoing 802.1Q VLAN: 0 >> Outgoing 802.1p priority: 0 >> Extended MPLS VC data >> Enterprise: standard sFlow (0) >> Format: Extended MPLS VC data (1009) >> Flow data length (byte): 28 >> VC Instance Name Length: 14 bytes >> VC Instance Name: FRANCE_IX_PROD >> VLL/VC ID: 20000 >> VC Label COS Value: 0 >> Flow sample, seq 24773752 >> Enterprise: standard sFlow (0) >> sFlow sample type: Flow sample (1) >> Sample length (byte): 184 >> Sequence number: 24773752 >> Source ID class: 0 index: 199 >> Sampling rate: 1 out of 8192 packets >> Sample pool: 1083113472 total packets >> Dropped packets: 2 >> Input interface: ifIndex 199 >> Output interface: ifIndex 132 >> Flow record: 3 >> Raw packet header >> Enterprise: standard sFlow (0) >> Format: Raw packet header (1) >> Flow data length (byte): 84 >> Header protocol: Ethernet (1) >> Frame Length: 70 bytes >> Payload removed: 4 bytes >> Header of sampled packet: >> 5c5eab043601001b5374697c080045000034da6340003c06... >> Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), >> Dst: JuniperN_04:36:01 (5c:5e:ab:04:36:01) >> Destination: JuniperN_04:36:01 (5c:5e:ab:04:36:01) >> Source: Cisco_74:69:7c (00:1b:53:74:69:7c) >> Type: IP (0x0800) >> Trailer: 5052 >> Internet Protocol Version 4, Src: 195.83.155.53 >> (195.83.155.53), Dst: 95.211.153.200 (95.211.153.200) >> Transmission Control Protocol, Src Port: 44684 >> (44684), Dst Port: http (80), Seq: 2654133139, Ack: 2910334516 >> Extended switch data >> Enterprise: standard sFlow (0) >> Format: Extended switch data (1001) >> Flow data length (byte): 16 >> Incoming 802.1Q VLAN: 4 >> Incoming 802.1p priority: 0 >> Outgoing 802.1Q VLAN: 0 >> Outgoing 802.1p priority: 0 >> Extended MPLS VC data >> Enterprise: standard sFlow (0) >> Format: Extended MPLS VC data (1009) >> Flow data length (byte): 28 >> VC Instance Name Length: 14 bytes >> VC Instance Name: FRANCE_IX_PROD >> VLL/VC ID: 20000 >> VC Label COS Value: 0 >> Flow sample, seq 24773753 >> Enterprise: standard sFlow (0) >> sFlow sample type: Flow sample (1) >> Sample length (byte): 184 >> Sequence number: 24773753 >> Source ID class: 0 index: 199 >> Sampling rate: 1 out of 8192 packets >> Sample pool: 1083121664 total packets >> Dropped packets: 1 >> Input interface: ifIndex 199 >> Output interface: ifIndex 386 >> Flow record: 3 >> Raw packet header >> Enterprise: standard sFlow (0) >> Format: Raw packet header (1) >> Flow data length (byte): 84 >> Header protocol: Ethernet (1) >> Frame Length: 70 bytes >> Payload removed: 4 bytes >> Header of sampled packet: >> 000cdbf50200001b5374697c080045000034c35200003b06... >> Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), >> Dst: BrocadeC_f5:02:00 (00:0c:db:f5:02:00) >> Destination: BrocadeC_f5:02:00 (00:0c:db:f5:02:00) >> Source: Cisco_74:69:7c (00:1b:53:74:69:7c) >> Type: IP (0x0800) >> Trailer: 0000 >> Internet Protocol Version 4, Src: 193.49.124.107 >> (193.49.124.107), Dst: 195.8.214.48 (195.8.214.48) >> Transmission Control Protocol, Src Port: 32981 >> (32981), Dst Port: http (80), Seq: 3330351549, Ack: 3890980799 >> Extended switch data >> Enterprise: standard sFlow (0) >> Format: Extended switch data (1001) >> Flow data length (byte): 16 >> Incoming 802.1Q VLAN: 4 >> Incoming 802.1p priority: 0 >> Outgoing 802.1Q VLAN: 0 >> Outgoing 802.1p priority: 0 >> Extended MPLS VC data >> Enterprise: standard sFlow (0) >> Format: Extended MPLS VC data (1009) >> Flow data length (byte): 28 >> VC Instance Name Length: 14 bytes >> VC Instance Name: FRANCE_IX_PROD >> VLL/VC ID: 20000 >> VC Label COS Value: 0 >> Flow sample, seq 24773754 >> Enterprise: standard sFlow (0) >> sFlow sample type: Flow sample (1) >> Sample length (byte): 232 >> Sequence number: 24773754 >> Source ID class: 0 index: 199 >> Sampling rate: 1 out of 8192 packets >> Sample pool: 1083129856 total packets >> Dropped packets: 1 >> Input interface: ifIndex 199 >> Output interface: ifIndex 193 >> Flow record: 4 >> Raw packet header >> Enterprise: standard sFlow (0) >> Format: Raw packet header (1) >> Flow data length (byte): 84 >> Header protocol: Ethernet (1) >> Frame Length: 70 bytes >> Payload removed: 4 bytes >> Header of sampled packet: >> 000cdbff0f00001b5374697c08004500003437b140003906... >> Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c), >> Dst: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00) >> Destination: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00) >> Source: Cisco_74:69:7c (00:1b:53:74:69:7c) >> Type: IP (0x0800) >> Trailer: 0000 >> Internet Protocol Version 4, Src: 193.50.95.245 >> (193.50.95.245), Dst: 69.46.69.171 (69.46.69.171) >> Transmission Control Protocol, Src Port: openmail >> (5729), Dst Port: http (80), Seq: 655905127, Ack: 2208916754 >> Extended switch data >> Enterprise: standard sFlow (0) >> Format: Extended switch data (1001) >> Flow data length (byte): 16 >> Incoming 802.1Q VLAN: 4 >> Incoming 802.1p priority: 0 >> Outgoing 802.1Q VLAN: 1 >> Outgoing 802.1p priority: 0 >> Extended MPLS VC data >> Enterprise: standard sFlow (0) >> Format: Extended MPLS VC data (1009) >> Flow data length (byte): 28 >> VC Instance Name Length: 14 bytes >> VC Instance Name: FRANCE_IX_PROD >> VLL/VC ID: 20000 >> VC Label COS Value: 0 >> Extended MPLS tunnel data >> Enterprise: standard sFlow (0) >> Format: Extended MPLS tunnel data (1008) >> Flow data length (byte): 40 >> Tunnel Name Length: 25 bytes >> Tunnel Name: es2.th2_es2.itx5_via_itx5 >> Tunnel ID: 0 >> Tunnel COS Value: 0 >> >> _______________________________________________ >> pmacct-discussion mailing list >> http://www.pmacct.net/#mailinglists > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
