YES! IT WORKS!
All I've need - just create ksocket with inet/rawip/divert hook connected to
ng_netflow iface0 hook (mkpeer netflow: ksocket iface0 inet/raw/divert),
then "msg netflow: setdlt { iface=0 dlt=12 }" (Raw ip instead of ethernet),
then "msg divert: bind inet/0.0.0.0:8888". And after all add ipfw rule "tee
8888 ip from any to any in"(One may need "via $oif") instead of final allow
(or, better, before it).
But there is bug in "ipfw tee" - packets is always immediately accepted
instead of continue going through the ruleset, so tee must be the last
rule(So, ng_netflow never see packets that denied by ipfw before tee rule).
Maybe there is way to use 'divert'? I've tried - packets going to divert
socket,then ng_netflow... and never come back... Actually I'm not quite
understand mechanism of returning from divert - ng_ksocket have only one
hook...
Great thanks to Julian & Gleb & all who helped!
2Gleb: It would be pleasure for me to write a little example based on our
discussion for README if you need.
Vasenin Alexander aka BlackSir
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Gleb Smirnoff
> Sent: Monday, February 23, 2004 1:43 PM
> To: Julian Elischer
> Cc: [EMAIL PROTECTED]; Bjoern A. Zeeb; Vasenin Alexander aka
> BlackSir; [EMAIL PROTECTED]
> Subject: Re: ng_netflow: testers are welcome
> On Sun, Feb 22, 2004 at 03:17:38PM -0800, Julian Elischer wrote:
> J> you can open a divert socket as a netgraph node by openning a ksocket
> J> node with protocol 'divert'.
> Really one can use "ipfw tee" to pass demasqueraded traffic to
> ng_netflow.
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
