Hello,
I mean that when you enable sflow on an interface you cannot configure
ingress/egress option.
It captures both directions while we need only data for ingress traffic.
There are two major problems with your solution. I think /direction /is
not a valid sfacct key and we already use pretagging(both tag,tag2) for
other purposes.
Regards,
On 07/27/2016 06:27 PM, Jentsch, Mario wrote:
Hi Jordan,
not sure what you mean with “equipment that cannot separate
inbound/outbound traffic” but as long as you have /direction/ in your
flow data you can add a pre-tag map like
/!/
/! tag=1 - inbound IPv4 traffic/
/! tag=2 - outbound IPv4 traffic/
/! tag=3 - inbound IPv6 traffic/
/! tag=4 - outbound IPv6 traffic/
/!/
/set_tag=1 ip=0.0.0.0/0 direction=0 filter='ip'/
/set_tag=2 ip=0.0.0.0/0 direction=1 filter='ip'/
/set_tag=3 ip=0.0.0.0/0 direction=0 filter='ip6'/
/set_tag=4 ip=0.0.0.0/0 direction=1 filter='ip6'/
/set_tag=0 ip=0.0.0.0/0/
/!/
and filter e.g. the ingress flows with
/!/
/pre_tag_filter[ingress]: 1,3/
/aggregate[ingress]: …/
/!/
Regards,
Mario
*From:*pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net]
*On Behalf Of *Jordan
*Sent:* Wednesday, July 27, 2016 5:06 PM
*To:* pmacct-discussion@pmacct.net
*Subject:* [pmacct-discussion] sfacct feature suggestion - traffic
in/out direction
Hello,
We're having issues with equipment that cannot separate
inbound/outbound traffic using sflow V5.
Looking at the sflow V5 protocol it's having the following fields.
Usually they match the snmp interface indexes.
/source_id/
/interface input/
/interface output/
What I suggest as a new feature are the following cases:
*Match_all_traffic*(by default) - matches all packets (as it currently
works)
*Match_input_only *- (if /source_id==interface input /permit, else
drop the rest of the samples)
*Match_output_only* - (if/ source_id==interface output/ permit,
else drop the rest of the samples)
Please let me know if such feature would be possible?
If there is any other already implemented solution I would be glad to
know.
Thank you in advance.
Best Regards,
--
---
Jordan
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
