Hi Matt,
nfdump does support ingress/egress vrfid filtering: 'ingress vrf <id>' 'egress
vrf <id>'
The tokens are %vrf, %ivrf, %evrf - see also man page nfdump.
Make sure nfcapd starts with at least -T31 ( or -Tall ) to collect this data,
otherwise, it's ignored.
Cheers
- Peter
On 16.07.14 22:55, Matthew A. Wiebelhaus wrote:
>>From what I can tell it is not possible to collect the ingress VRF ID
> field from Cisco ASR1000 and other Cisco routers that utilize flexible
> NetFlow (version 9). If possible I would like to extend nfdump to collect
> and report this field. I have done some work with implementing the extra
> output tag which I am calling simply calling "%vrf" for now, and have got
> it to the point where nfdump will simply print "0" for all flows. I was
> hoping somebody could point me in the right direction as to which source
> files I need to be focusing on to implement the rest of this. Attached is
> a screenshot of a wireshark capture which shows this field in the template
> I am exporting. Any help or suggestions would be appreciated.
>
>
>
> Thanks,
>
> Matt Wiebelhaus
> Network Systems Design
> Email: mawie...@up.com
>
>
> **
>
> This email and any attachments may contain information that is confidential
> and/or privileged for the sole use of the intended recipient. Any use,
> review, disclosure, copying, distribution or reliance by others, and any
> forwarding of this email or its contents, without the express permission of
> the sender is strictly prohibited by law. If you are not the intended
> recipient, please contact the sender immediately, delete the e-mail and
> destroy all copies.
> **
>
>
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
>
>
>
> _______________________________________________
> Nfdump-discuss mailing list
> Nfdump-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
Infragistics Professional
Build stunning WinForms apps today!
Reboot your WinForms applications with our WinForms controls.
Build a bridge from your legacy apps to the future.
http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk
_______________________________________________
Nfdump-discuss mailing list
Nfdump-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
