Hi Derrick, Inline:
On Wed, Mar 02, 2016 at 03:00:17PM -0800, Derrick Sawyer wrote: > Also, are you sending v4 and v6 AFs over a v4 BGP session or > you have two BGP sessions, one v4 and one v6? > *-- Sending v4 & v6 over v4 session. What be the best way to have a v4 an > v6 session? 2 config files or can this be done from a single conf?* I recommend sending v4 and v6 AF's over the same v4 BGP session; this is because v4 and v6 flows are both sent via the same NetFlow v4 address and this eases correlation. Otherwise you would need a bgp_agent_map, ie. overhead, to make it work; something like: bgp_ip=10.10.10.0 ip=10.10.10.0 filter=ip bgp_ip=<IPv6 address> ip=10.10.10.0 filter=ip6 Which reads: correlate v4 flows from 10.10.10.0 to the BGP session with 10.10.10.0 and correlate v6 flows from 10.10.10.0 to the BGP session with <IPv6 address>. This is only a recommendation and if, for whatever reason including architectural policies, one has to build two BGP sessions, v4 and v6, then this is supported (via a a bgp_agent_map snippet like the above). > What is the content of the file pointed by bgp_agent_map? > *-- This is the peering routers IPs (changed but looks like this)* > *bgp_ip=10.10.10.0 ip=10.10.10.0bgp_ip=10.10.11.0 ip=10.10.10.0* This is not needed, you can skip the map all together as this kind of correlation is the only one done automagically for you (ie. see if there is a BGP session from an IP address or with a BGP session ID same as the IP address with which NetFlow packets are exported). > do you see v6 prefixes landing allright onto pmacct, ie. as part of the > content of the file pointed by bgp_daemon_msglog_file? > *-- When I use the src_host agg, I see v6 addresses but not when using the > src_net agg. I do not see any v6 prefixes in bgp_daemon_msglog_file* Then here could be the issue: can you check on your router that it is actually sending the v6 prefixes? With something equivalent to "show ip bgp neighbors <nfacctd VM IP address> advertised-routes" on IOS? Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
