Hello Paolo,

Thank you for the reference.  I just looked at this and tested it but it
did not filter out the network I specified.  When I wiresharked on the
receiving host it was showing all traffic but not the specified network
(src_net=192.168.0.0/24) .

Below are the configs I used:

# nfacctd.conf
daemonize: false
nfacctd_port: 2055
nfacctd_ip: 0.0.0.0
logfile: /var/log/nfacctd.log

tee_transparent: true
maps_index: true

plugins: tee[a]

tee_receivers[a]: tee_receivers.lst
pre_tag_map[a]: pretag.map

plugin_buffer_size: 10240
plugin_pipe_size: 1024000
nfacctd_pipe_size: 1024000

# tee_receivers.lst
id=100 ip=192.168.10.50:3056

# pretag.map
set_tag=100     ip=0.0.0.0/0    src_net=192.168.0.0/24

I'm using nfacctd 1.7.5-git (20200510-00); FYI

Is there another part I'm missing from the config?

Thank you!
Eric




On Wed, Nov 18, 2020 at 10:46 AM Paolo Lucente <[email protected]> wrote:

>
> Hi Eric,
>
> You could look at this piece of documentation for what you are trying to
> do: https://github.com/pmacct/pmacct/blob/1.7.5/QUICKSTART#L2106-#L2200
>
> The example focuses on src_mac and dst_mac, you should be using src_net
> and dst_net instead.
>
> Paolo
>
> On 18/11/2020 05:38, eric c wrote:
> > Good afternoon,
> >
> > Tring to setup nfacctd as replicator but would like to filter what
> > subnets to replicate to the next receiver.
> >
> > Below is a config that is working without filtering:
> >
> > # nfacctd.conf
> > daemonize: false
> > nfacctd_port: 2055
> > nfacctd_ip: 0.0.0.0
> > logfile: /var/log/nfacctd.log
> >
> > plugins: tee[a]
> > tee_receivers[a]: tee_nflow_receivers.lst
> > tee_transparent: true
> >
> > # tee_nflow_receivers.lst
> > id=1 ip=192.168.10.50:3056 <http://192.168.10.50:3056>
> >
> > What config change can I add to only replicate IP src/dst to 10.0.0.0/24
> > <http://10.0.0.0/24> and 192.168.0.0/24 <http://192.168.0.0/24> for
> example?
> >
> > Thank you!
> > Eric
> >
> > _______________________________________________
> > pmacct-discussion mailing list
> > http://www.pmacct.net/#mailinglists
> >
>
>
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
>
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to