Hi Teun, Makes perfect sense & would appreciate if you get back privately either way.
Cheers, Paolo On Mon, Nov 10, 2014 at 09:50:22AM +0100, Teun Vink wrote: > Hi Paolo, > > Thanks for the reply. Too bad this feature isn't available at this > moment. I think we'll take a look for alternatives, but I might get back > to you in a private mail if we can't find any. > > Best regards, > Teun > > On zo, 2014-11-09 at 02:16 +0000, Paolo Lucente wrote: > > Hi Teun, > > > > The scenario is clear but unfortunately what you are trying to do is > > currently not supported: you can currently split NetFlow based on some > > NetFlow packet characteristics (ie. sourceID, source IP address, etc.) > > but not on the characteristics of flows included in the packet. Reason > > being the NetFlow packet should be really processed and reassembled. > > > > That said, this precise feature was of interest to an IXP. We may move > > to private emails to see: how much interest you have in this, what are > > your timelines, whether you would be available to field trial this dev > > (granted of course we are positive on interest and timelines). > > > > Cheers, > > Paolo > > > > On Fri, Nov 07, 2014 at 03:21:33PM +0100, Teun Vink wrote: > > > Hi, > > > > > > I'm looking for a solution for the following: we have a transit router > > > which generates netflow data for our network, which provides transit > > > services to various customers. We would like to be able to provide > > > netflow data to our customers, but of course, we can only provide them > > > with data for their network, so we need filtering. Of course I'd usually > > > would have fixed this by enabling netflow on the customer facing > > > interfaces, but for this specific network this is not possible. So I > > > need a way to split and replay my flows. > > > > > > Looking for a way to split incoming netflow packets based on > > > characteristics (source/destination IP and/or next-hop ASN) I found > > > pmacct. > > > > > > I played with the "tee" plugin combined with a pre_tag_map for some > > > time, but couldn't get this to work yet. > > > > > > My config looked like this: > > > > > > == nfacctd.conf == > > > plugins: tee[cust] > > > tee_transparent: true > > > pre_tag_map: /etc/pmacct/pretag.map > > > tee_receivers[cust]: /etc/pmacct/tee_receivers.lst > > > > > > == pre-tag.map == > > > set_tag=100 ip=10.0.0.0/8 > > > set_tag=200 ip=192.168.0.0/24 > > > > > > == tee_receivers.lst == > > > id=2 ip=10.11.12.13:5000 tag=100 > > > id=3 ip=192.168.1.1:5000 tag=200 > > > > > > > > > Is what I want to do even possible, and if so, what am I doing wrong > > > here? > > > > > > Thanks for the help, > > > Teun > > > > > > > > > _______________________________________________ > > > pmacct-discussion mailing list > > > http://www.pmacct.net/#mailinglists > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > > > > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
