Hi Teun, The scenario is clear but unfortunately what you are trying to do is currently not supported: you can currently split NetFlow based on some NetFlow packet characteristics (ie. sourceID, source IP address, etc.) but not on the characteristics of flows included in the packet. Reason being the NetFlow packet should be really processed and reassembled.
That said, this precise feature was of interest to an IXP. We may move to private emails to see: how much interest you have in this, what are your timelines, whether you would be available to field trial this dev (granted of course we are positive on interest and timelines). Cheers, Paolo On Fri, Nov 07, 2014 at 03:21:33PM +0100, Teun Vink wrote: > Hi, > > I'm looking for a solution for the following: we have a transit router > which generates netflow data for our network, which provides transit > services to various customers. We would like to be able to provide > netflow data to our customers, but of course, we can only provide them > with data for their network, so we need filtering. Of course I'd usually > would have fixed this by enabling netflow on the customer facing > interfaces, but for this specific network this is not possible. So I > need a way to split and replay my flows. > > Looking for a way to split incoming netflow packets based on > characteristics (source/destination IP and/or next-hop ASN) I found > pmacct. > > I played with the "tee" plugin combined with a pre_tag_map for some > time, but couldn't get this to work yet. > > My config looked like this: > > == nfacctd.conf == > plugins: tee[cust] > tee_transparent: true > pre_tag_map: /etc/pmacct/pretag.map > tee_receivers[cust]: /etc/pmacct/tee_receivers.lst > > == pre-tag.map == > set_tag=100 ip=10.0.0.0/8 > set_tag=200 ip=192.168.0.0/24 > > == tee_receivers.lst == > id=2 ip=10.11.12.13:5000 tag=100 > id=3 ip=192.168.1.1:5000 tag=200 > > > Is what I want to do even possible, and if so, what am I doing wrong > here? > > Thanks for the help, > Teun > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
