Hi Timo, All of that should fall in the pre_tag_filter domain but I can anticipate you none of the fields you are mentioning (ie. post_nat_src_host, src_host_country or nat_event) are currently supported. What would be your use-case? Feel free to say here or via unicast email.
Paolo On Tue, Feb 28, 2017 at 01:54:14PM +0100, Timo Lindhorst wrote: > Hi, > > we're currently digging into pmacct and friends and I'm quite happy > about its feature set and extensibility. > > Now, I face a probably not so uncommon use case, which I'm not able > to find a simple solution for: > > The `aggregate_filter` key allows to filter flows before passing them > to a plugin. The filter syntax is supposed to be a pcap-filter: > aggregate_filter[inbound]: dst net 192.168.0.0/16 > > However, is there a way to filter for non-pcap attributes, like > src_host_country or nat_event? In my present case, I like to filter > the post_nat_src_host to be in a given network, but I don't see > a way to do this with aggregate_filter and pcap syntax. > > The documentation for aggregate_filter says: > > This directive can be used in conjunction with 'pre_tag_filter' > > (which, in turn, allows to filter tags). > Hence, I guess it should be possible to filter for tags. However, > trying `tag 1` as filter results in a "syntax error". > > I appreciate any help or hint how to approach this. > > Thanks in advance > Timo > > > > > > -- > Dipl.-Ing.-Inf. Timo Lindhorst > > email: [email protected] > phone: +49-391-819099-236 > > ----------------------- enabling your networks ---------------------- > > Travelping GmbH phone: +49-391-81 90 99 0 > Roentgenstr. 13, 39108 Magdeburg fax: +49-391-81 90 99 299 > Koernerstr. 7-10, 10785 Berlin email: [email protected] > GERMANY web: http://www.travelping.com > > Company Registration: Amtsgericht Stendal Reg No.: HRB 10578 > Geschaeftsfuehrer: Holger Winkelmann VAT ID No.: DE236673780 > --------------------------------------------------------------------- _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
