On Thu, 9 Sep 2004, Andre Oppermann wrote: > The only thing the kernel *may* know about is the right- and leftmost AS. > It may be more efficient to send the netflow data through a small helper > application that just fills in the two AS number based on a mrt dump.
where and when ? that's not really possible I guess. Gleb currently sends the flows directly via a ksocket. Of course one could pass them to userspace but ... One would need sth like a "callback hook" into userspace to query a (routing) daemon before sending the flow. I once did an ugly posix local socket based lookup patch to zebra so traceroute could extract AS#s. and an extra hook, if connected ask the userspace daemon (be it the routing daemon or an intermediate) at the other end for the AS# once the flow starts and if you get an answer fill it in; if you don't leave it empty. What I'd like to ask but did not because I didn't really have a chance to view more than documentation is: - what is the memory impact of this node ? - can it cope with 50++ Mbit/s UDP worms scanning large subnets ? -- Bjoern A. Zeeb bzeeb at Zabbadoz dot NeT _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
