Hi Thomas, Comments in-line:
On Tue, Jun 03, 2014 at 02:48:33PM +0000, Thomas King wrote: > We double checked the IPFIX data coming from our router. The sampling rate is > contained in the data. It comes via a data record (template id=256) and the > relevant fields are named samplingPacketInterval and samplingPacketSpace. > Do you know if pmacct is able to recognise this information? Is there is > anything else (configuration file wise) what we can do? It definitely should. I recommend to send me over privately a brief trace of a few IPFIX packets (templates and data records) to look into the issue. If actual flow data records is a problem, you can send over only the sampling related part (option template plus option record), it might be sufficient to nail down the issue. > We tried “aggregate: etype” but we then see just 0x0800 (IPv4) traffic. We do > not see any 0x86dd (IPv6) traffic. I assume the reason is that the template > (L2-IP) we use does not provide any ethernet type field as I just learned. > From my understanding the field IP Version (IANA element ID=60) would be the > one that should be inspected. Does pmacct support the IP Version field? Not natively. But you have a framework, aggregate_primitives config directive, and an example for its use in examples/primitives.lst in the standard pmacct code distribution, to define custom primitives. It should be as simple as you add the following to your config: aggregate_primitives: /path/to/primitives.lst aggregate: < .. other primitives .. >, ip_version Then define ip_version primitive in /path/to/primitives.lst as: name=ip_version field_type=60 len=1 semantics=u_int > I would like to have a tool that takes all the data available from pmacct via > a memory socket and writes it periodically to rrd files. At a first glance > PNRG did this. However, if a rrd filename is like a mac address PNRG stops > working. Additionally, PNRG is not supported anymore. So I am looking for a > similar tool. Are you aware of any tool that does this? No. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
