I also need to IPv4/IPv6 classification and tried your method. Here is
my config:
daemonize: true
pidfile: /var/run/sfacctd.pid
syslog: daemon
!
aggregate[ipv4]: none
imt_path[ipv4]: /tmp/ipv4.pipe
aggregate_filter[ipv4]: ip
sfacctd_ip:<hidden>
sfacctd_port: 6343
sfacctd_renormalize: true
!
! storage methods
plugins: memory[ipv4]
Problem is everything gets filtered, counters are empty. If I remove
aggregate_filter, counters work.
All other aggregation methods work (src_mac, dts_mac, etc), but using
aggregate_filter to filter ip protocol does not.
Any idea anyone ?
Here is a sample SFlow packet:
No. Time Source Destination
Protocol Length Info
1 0.000000 10.120.0.251 10.120.0.161 sFlow
1246 V5, agent 10.200.1.12, sub-agent ID 4, seq 5068874, 6 samples
Frame 1: 1246 bytes on wire (9968 bits), 1246 bytes captured (9968 bits)
Ethernet II, Src: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00), Dst:
DigitalE_75:99:38 (aa:00:00:75:99:38)
Destination: DigitalE_75:99:38 (aa:00:00:75:99:38)
Source: BrocadeC_bd:71:00 (00:1b:ed:bd:71:00)
Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.120.0.251 (10.120.0.251), Dst:
10.120.0.161 (10.120.0.161)
User Datagram Protocol, Src Port: ddi-udp-1 (8888), Dst Port: sflow (6343)
InMon sFlow
Datagram version: 5
Agent address: 10.200.1.12 (10.200.1.12)
Sub-agent ID: 4
Sequence number: 5068874
SysUptime: 2304446650
NumSamples: 6
Flow sample, seq 24773749
Enterprise: standard sFlow (0)
sFlow sample type: Flow sample (1)
Sample length (byte): 184
Sequence number: 24773749
Source ID class: 0 index: 199
Sampling rate: 1 out of 8192 packets
Sample pool: 1083088896 total packets
Dropped packets: 1
Input interface: ifIndex 199
Output interface: ifIndex 136
Flow record: 3
Raw packet header
Enterprise: standard sFlow (0)
Format: Raw packet header (1)
Flow data length (byte): 84
Header protocol: Ethernet (1)
Frame Length: 70 bytes
Payload removed: 4 bytes
Header of sampled packet:
0012f23b6ab3001b5374697c0800450000348cbd40003906...
Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c),
Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3)
Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3)
Source: Cisco_74:69:7c (00:1b:53:74:69:7c)
Type: IP (0x0800)
Trailer: 0101
Internet Protocol Version 4, Src: 138.102.77.171
(138.102.77.171), Dst: 95.140.238.31 (95.140.238.31)
Transmission Control Protocol, Src Port: 35723
(35723), Dst Port: macromedia-fcs (1935), Seq: 1292250320, Ack:
2432302115
Extended switch data
Enterprise: standard sFlow (0)
Format: Extended switch data (1001)
Flow data length (byte): 16
Incoming 802.1Q VLAN: 4
Incoming 802.1p priority: 0
Outgoing 802.1Q VLAN: 0
Outgoing 802.1p priority: 0
Extended MPLS VC data
Enterprise: standard sFlow (0)
Format: Extended MPLS VC data (1009)
Flow data length (byte): 28
VC Instance Name Length: 14 bytes
VC Instance Name: FRANCE_IX_PROD
VLL/VC ID: 20000
VC Label COS Value: 0
Flow sample, seq 24773750
Enterprise: standard sFlow (0)
sFlow sample type: Flow sample (1)
Sample length (byte): 172
Sequence number: 24773750
Source ID class: 0 index: 199
Sampling rate: 1 out of 8192 packets
Sample pool: 1083097088 total packets
Dropped packets: 2
Input interface: ifIndex 199
Output interface: ifIndex 136
Flow record: 3
Raw packet header
Enterprise: standard sFlow (0)
Format: Raw packet header (1)
Flow data length (byte): 72
Header protocol: Ethernet (1)
Frame Length: 58 bytes
Payload removed: 4 bytes
Header of sampled packet:
0012f23b6ab3001b5374697c08004500002876c340007706...
Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c),
Dst: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3)
Destination: BrocadeC_3b:6a:b3 (00:12:f2:3b:6a:b3)
Source: Cisco_74:69:7c (00:1b:53:74:69:7c)
Type: IP (0x0800)
Trailer: c53e
Internet Protocol Version 4, Src: 193.49.162.19
(193.49.162.19), Dst: 87.248.221.27 (87.248.221.27)
Transmission Control Protocol, Src Port: 29707
(29707), Dst Port: https (443), Seq: 2702398055, Ack: 29921351
Extended switch data
Enterprise: standard sFlow (0)
Format: Extended switch data (1001)
Flow data length (byte): 16
Incoming 802.1Q VLAN: 4
Incoming 802.1p priority: 0
Outgoing 802.1Q VLAN: 0
Outgoing 802.1p priority: 0
Extended MPLS VC data
Enterprise: standard sFlow (0)
Format: Extended MPLS VC data (1009)
Flow data length (byte): 28
VC Instance Name Length: 14 bytes
VC Instance Name: FRANCE_IX_PROD
VLL/VC ID: 20000
VC Label COS Value: 0
Flow sample, seq 24773751
Enterprise: standard sFlow (0)
sFlow sample type: Flow sample (1)
Sample length (byte): 172
Sequence number: 24773751
Source ID class: 0 index: 199
Sampling rate: 1 out of 8192 packets
Sample pool: 1083105280 total packets
Dropped packets: 1
Input interface: ifIndex 199
Output interface: ifIndex 388
Flow record: 3
Raw packet header
Enterprise: standard sFlow (0)
Format: Raw packet header (1)
Flow data length (byte): 72
Header protocol: Ethernet (1)
Frame Length: 58 bytes
Payload removed: 4 bytes
Header of sampled packet:
001f12b7ec84001b5374697c080045000028bcd940007606...
Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c),
Dst: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84)
Destination: JuniperN_b7:ec:84 (00:1f:12:b7:ec:84)
Source: Cisco_74:69:7c (00:1b:53:74:69:7c)
Type: IP (0x0800)
Trailer: 0090
Internet Protocol Version 4, Src: 194.199.34.163
(194.199.34.163), Dst: 194.190.77.154 (194.190.77.154)
Transmission Control Protocol, Src Port: tunstall-pnc
(1846), Dst Port: macromedia-fcs (1935), Seq: 2439192598, Ack:
1870757431
Extended switch data
Enterprise: standard sFlow (0)
Format: Extended switch data (1001)
Flow data length (byte): 16
Incoming 802.1Q VLAN: 4
Incoming 802.1p priority: 0
Outgoing 802.1Q VLAN: 0
Outgoing 802.1p priority: 0
Extended MPLS VC data
Enterprise: standard sFlow (0)
Format: Extended MPLS VC data (1009)
Flow data length (byte): 28
VC Instance Name Length: 14 bytes
VC Instance Name: FRANCE_IX_PROD
VLL/VC ID: 20000
VC Label COS Value: 0
Flow sample, seq 24773752
Enterprise: standard sFlow (0)
sFlow sample type: Flow sample (1)
Sample length (byte): 184
Sequence number: 24773752
Source ID class: 0 index: 199
Sampling rate: 1 out of 8192 packets
Sample pool: 1083113472 total packets
Dropped packets: 2
Input interface: ifIndex 199
Output interface: ifIndex 132
Flow record: 3
Raw packet header
Enterprise: standard sFlow (0)
Format: Raw packet header (1)
Flow data length (byte): 84
Header protocol: Ethernet (1)
Frame Length: 70 bytes
Payload removed: 4 bytes
Header of sampled packet:
5c5eab043601001b5374697c080045000034da6340003c06...
Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c),
Dst: JuniperN_04:36:01 (5c:5e:ab:04:36:01)
Destination: JuniperN_04:36:01 (5c:5e:ab:04:36:01)
Source: Cisco_74:69:7c (00:1b:53:74:69:7c)
Type: IP (0x0800)
Trailer: 5052
Internet Protocol Version 4, Src: 195.83.155.53
(195.83.155.53), Dst: 95.211.153.200 (95.211.153.200)
Transmission Control Protocol, Src Port: 44684
(44684), Dst Port: http (80), Seq: 2654133139, Ack: 2910334516
Extended switch data
Enterprise: standard sFlow (0)
Format: Extended switch data (1001)
Flow data length (byte): 16
Incoming 802.1Q VLAN: 4
Incoming 802.1p priority: 0
Outgoing 802.1Q VLAN: 0
Outgoing 802.1p priority: 0
Extended MPLS VC data
Enterprise: standard sFlow (0)
Format: Extended MPLS VC data (1009)
Flow data length (byte): 28
VC Instance Name Length: 14 bytes
VC Instance Name: FRANCE_IX_PROD
VLL/VC ID: 20000
VC Label COS Value: 0
Flow sample, seq 24773753
Enterprise: standard sFlow (0)
sFlow sample type: Flow sample (1)
Sample length (byte): 184
Sequence number: 24773753
Source ID class: 0 index: 199
Sampling rate: 1 out of 8192 packets
Sample pool: 1083121664 total packets
Dropped packets: 1
Input interface: ifIndex 199
Output interface: ifIndex 386
Flow record: 3
Raw packet header
Enterprise: standard sFlow (0)
Format: Raw packet header (1)
Flow data length (byte): 84
Header protocol: Ethernet (1)
Frame Length: 70 bytes
Payload removed: 4 bytes
Header of sampled packet:
000cdbf50200001b5374697c080045000034c35200003b06...
Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c),
Dst: BrocadeC_f5:02:00 (00:0c:db:f5:02:00)
Destination: BrocadeC_f5:02:00 (00:0c:db:f5:02:00)
Source: Cisco_74:69:7c (00:1b:53:74:69:7c)
Type: IP (0x0800)
Trailer: 0000
Internet Protocol Version 4, Src: 193.49.124.107
(193.49.124.107), Dst: 195.8.214.48 (195.8.214.48)
Transmission Control Protocol, Src Port: 32981
(32981), Dst Port: http (80), Seq: 3330351549, Ack: 3890980799
Extended switch data
Enterprise: standard sFlow (0)
Format: Extended switch data (1001)
Flow data length (byte): 16
Incoming 802.1Q VLAN: 4
Incoming 802.1p priority: 0
Outgoing 802.1Q VLAN: 0
Outgoing 802.1p priority: 0
Extended MPLS VC data
Enterprise: standard sFlow (0)
Format: Extended MPLS VC data (1009)
Flow data length (byte): 28
VC Instance Name Length: 14 bytes
VC Instance Name: FRANCE_IX_PROD
VLL/VC ID: 20000
VC Label COS Value: 0
Flow sample, seq 24773754
Enterprise: standard sFlow (0)
sFlow sample type: Flow sample (1)
Sample length (byte): 232
Sequence number: 24773754
Source ID class: 0 index: 199
Sampling rate: 1 out of 8192 packets
Sample pool: 1083129856 total packets
Dropped packets: 1
Input interface: ifIndex 199
Output interface: ifIndex 193
Flow record: 4
Raw packet header
Enterprise: standard sFlow (0)
Format: Raw packet header (1)
Flow data length (byte): 84
Header protocol: Ethernet (1)
Frame Length: 70 bytes
Payload removed: 4 bytes
Header of sampled packet:
000cdbff0f00001b5374697c08004500003437b140003906...
Ethernet II, Src: Cisco_74:69:7c (00:1b:53:74:69:7c),
Dst: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00)
Destination: BrocadeC_ff:0f:00 (00:0c:db:ff:0f:00)
Source: Cisco_74:69:7c (00:1b:53:74:69:7c)
Type: IP (0x0800)
Trailer: 0000
Internet Protocol Version 4, Src: 193.50.95.245
(193.50.95.245), Dst: 69.46.69.171 (69.46.69.171)
Transmission Control Protocol, Src Port: openmail
(5729), Dst Port: http (80), Seq: 655905127, Ack: 2208916754
Extended switch data
Enterprise: standard sFlow (0)
Format: Extended switch data (1001)
Flow data length (byte): 16
Incoming 802.1Q VLAN: 4
Incoming 802.1p priority: 0
Outgoing 802.1Q VLAN: 1
Outgoing 802.1p priority: 0
Extended MPLS VC data
Enterprise: standard sFlow (0)
Format: Extended MPLS VC data (1009)
Flow data length (byte): 28
VC Instance Name Length: 14 bytes
VC Instance Name: FRANCE_IX_PROD
VLL/VC ID: 20000
VC Label COS Value: 0
Extended MPLS tunnel data
Enterprise: standard sFlow (0)
Format: Extended MPLS tunnel data (1008)
Flow data length (byte): 40
Tunnel Name Length: 25 bytes
Tunnel Name: es2.th2_es2.itx5_via_itx5
Tunnel ID: 0
Tunnel COS Value: 0
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
