Re: [pmacct-discussion] IPv4 and IPv6 sFlow BGP AS

Сергей Горшков Fri, 02 Dec 2016 15:28:38 -0800

Hi Paolo, thank you for the answer

root@pmacct:/etc/pmacct# cat bgp_agent.map
bgp_ip=176.**.**.252          ip=0.0.0.0/0    filter='ip'
bgp_ip=2001:**:**:1::11      ip=0.0.0.0/0    filter='ip6'


Unfortunately, it did not help:-(
Running takes place perfectly

Dec 03 01:07:22 INFO ( default/core ): Trying to (re)load map:/etc/pmacct/bgp_agent.mapDec 03 01:07:22 INFO ( default/core ): map '/etc/pmacct/bgp_agent.map'successfully (re)loaded.

Dec 03 01:07:22 INFO ( default/core/BGP ): maximum BGP peers allowed: 4
Dec 03 01:07:22 INFO ( default/core/BGP ): waiting for BGP data on :::179
Dec 03 01:07:24 INFO ( default/core/BGP ): BGP peers usage: 1/4

Dec 03 01:07:24 INFO ( default/core/BGP ): Capability: MultiProtocol [1]AFI [1] SAFI [1]Dec 03 01:07:24 INFO ( default/core/BGP ): Capability: 4-bytes AS [41]ASN [5**81]Dec 03 01:07:24 INFO ( default/core/BGP ): [Id: 31.**.**.2] BGP_OPEN:Asn: 5**81 HoldTime: 240

Dec 03 01:07:27 INFO ( default/core ): waiting for sFlow data on :::6343

Dec 03 01:07:27 INFO ( default/mysql ): cache entries=32771 base cachememory=11369224 bytesDec 03 01:08:01 INFO ( default/mysql ): *** Purging cache - START (PID:1239) ***Dec 03 01:08:01 INFO ( default/mysql ): *** Purging cache - END (PID:1239, QN: 3618/3618, ET: 0) ***

Dec 03 01:08:59 INFO ( default/core/BGP ): BGP peers usage: 2/4

Dec 03 01:08:59 INFO ( default/core/BGP ): Capability: MultiProtocol [1]AFI [2] SAFI [1]Dec 03 01:08:59 INFO ( default/core/BGP ): Capability: 4-bytes AS [41]ASN [5**81]Dec 03 01:08:59 INFO ( default/core/BGP ): [Id: 176.**.**.97] BGP_OPEN:Asn: 5**81 HoldTime: 180


But here's the result of a
+----------+------+--------+--------+---------------------+-------------------+----------+----------+----------+---------+-------+-------+---------------------+---------------------+

+----------+------+--------+--------+---------------------+-------------------+----------+----------+----------+---------+-------+-------+---------------------+---------------------+

| 0 | 3855 | 0 | 0 | 2001:4860::1:0:893c |2001:67c:2d40::47 | 0 | 0 | ipv6-i | 1 | 214 |0 | 2016-12-03 01:00:00 | 2016-12-03 01:14:01 |

+----------+------+--------+--------+---------------------+-------------------+----------+----------+----------+---------+-------+-------+---------------------+---------------------+
and

| 0 | 3800 | 0 | 0 | 31.43.61.166 |185.38.12.42 | 56911 | 80 | tcp | 1 | 64| 0 | 2016-12-03 01:00:00 | 2016-12-03 01:08:01 |


Perhaps this will give a little more information to solve the problem
Sfacct version
#sfacctd -V
sFlow Accounting Daemon, sfacctd 1.5.2 (20150907-00)
 --build=x86_64-linux-gnu

--prefix=/usr '--includedir=${prefix}/include''--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info'

 --sysconfdir=/etc
 --localstatedir=/var

--disable-silent-rules '--libdir=${prefix}/lib/x86_64-linux-gnu''--libexecdir=${prefix}/lib/x86_64-linux-gnu' --disable-maintainer-mode

 --disable-dependency-tracking
 --enable-mmap
 --enable-pgsql
 --with-pgsql-includes=/usr/include/postgresql
 --enable-mysql
 --enable-sqlite3
 --enable-ipv6
 --enable-v4-mapped
 --enable-64bit
 --enable-threads
 --enable-jansson
 --enable-geoip
 --enable-rabbitmq
-----------------------------------------------------------
Database
create table acct_v6 (
    agent_id INT(4) UNSIGNED NOT NULL,
    class_id CHAR(16) NOT NULL,
    vlan INT(2) UNSIGNED NOT NULL,
    as_src INT(4) UNSIGNED NOT NULL,
    as_dst INT(4) UNSIGNED NOT NULL,
    ip_src CHAR(15) NOT NULL,
    ip_dst CHAR(15) NOT NULL,
    src_port INT(2) UNSIGNED NOT NULL,
    dst_port INT(2) UNSIGNED NOT NULL,
    ip_proto CHAR(6) NOT NULL,
    packets INT UNSIGNED NOT NULL,
    bytes BIGINT UNSIGNED NOT NULL,
    flows INT UNSIGNED NOT NULL,
    stamp_inserted DATETIME NOT NULL,
    stamp_updated DATETIME,

PRIMARY KEY (agent_id, class_id, vlan, as_src, as_dst, ip_src,ip_dst, src_port, dst_port, ip_proto, stamp_inserted)

);

For suggestions, critics, bugs, contact me: Paolo Lucente<[email protected]>.


03.12.2016 0:03, Paolo Lucente пишет:

Hi Sergey,

I guess what you need is to refine your bgp_agent_map as follows:

bgp_ip=176.**.**.252         ip=0.0.0.0/0       filter='ip'
bgp_ip=2001:**:**:1::11      ip=0.0.0.0/0       filter='ip6'

Let me know if this works for you.

Cheers,
Paolo

On Fri, Dec 02, 2016 at 08:09:07PM +0200, Сергей Горшков wrote:

Hi all.

I need your help because I am in a deadlock

My config

#cat sfacctd.conf
! sfacctd configuration
!
!
!
daemonize:              true
interface:              any
pidfile:                /var/run/sfacctd.pid
syslog:                 daemon
logfile:                /var/log/sfacct.log
!
sfacctd_as_new:         bgp
bgp_daemon:             true
bgp_agent_map:          /etc/pmacct/bgp_agent.map
!
aggregate: tag,vlan,src_as,dst_as,src_host,dst_host,src_port,dst_port,proto
!
plugins:                mysql
sql_db:                 pmacct
sql_table_version:      6
sql_table:              acct_v6
sql_host:               localhost
sql_user:               *****
sql_passwd:             *****
sql_refresh_time:       60
sql_optimize_clauses:   true
sql_history:            1h
sql_history_roundoff:   h
sql_locking_style:      row
------------------------------------------------------

# cat bgp_agent.map
bgp_ip=176.**.**.252          ip=0.0.0.0/0
bgp_ip=2001:**:**:1::11      ip=0.0.0.0/0
------------------------------------------------------
In this configuration, all IP6 addresses obtained AS 0

select * from acct_v6 where ip_src like '%2001:4860%';
+----------+------+--------+--------+---------------------+-------------------+----------+----------+----------+---------+-------+-------+---------------------+---------------------+
| agent_id | vlan | as_src | as_dst | ip_src              |
ip_dst            | src_port | dst_port | ip_proto | packets | bytes |
flows | stamp_inserted      | stamp_updated       |
+----------+------+--------+--------+---------------------+-------------------+----------+----------+----------+---------+-------+-------+---------------------+---------------------+
|        0 | 3855 |      0 |      0 | 2001:4860::8:0:8f90 |
2001:67c:2d40::47 |        0 |        0 | ipv6-i   |       2 | 428 |
0 | 2016-12-01 11:00:00 | 2016-12-01 11:35:01 |

IP4 everything is fine

|        0 | 3905 |  15169 |  50581 | 173.194.21.80   | 31.43.60.150
|      443 |    21668 | tcp      |       2 |  3044 |     0 | 2016-12-01
11:00:00 | 2016-12-01 11:16:01 |

If BGP neighbors to change their place

# cat bgp_agent.map
bgp_ip=2001:**:**:1::11      ip=0.0.0.0/0
bgp_ip=176.**.**.252          ip=0.0.0.0/0

Then get IP6 AS number and get IP4 AS0
How to make sFacct collated both IP4 and IP6 addresses with an
autonomous system number??



_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists



_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] IPv4 and IPv6 sFlow BGP AS

Reply via email to