Thank you for your help. Appreciate it ! See, I did use it for testing after I sent this email. However, the ip showed there was the IP from my nfacctd machine, the collector itself. Not the exporter.
peer_src_ip : IP address or identificator of telemetry exporting device In fact, it may have todo with the fact I currently have an SSH tunnel with socat with the remote machine in order to collect the data. This may be the reason why which is definitively not a ordinary condition. :) I am wondering if I could use this one to include a different tag on it process/collector, but have not yet figured out how. Any thoughts ? label : String label, ie. as result of pre_tag_map evaluation Thank you again. On Mon, Apr 13, 2020 at 9:07 AM Paolo Lucente <pa...@pmacct.net> wrote: > > Hi Emanuel, > > I think you are looking for (i admit, non-intuitive) 'peer_src_ip' > primitive: > > $ nfacctd -a | grep peer_src_ip > peer_src_ip : IP address or identificator of > telemetry exporting device > > Without the grep you can see all supported primitives by the nfacctd > release you are using along with a text explanation. > > Paolo > > On Sun, Apr 12, 2020 at 06:55:26PM -0400, Emanuel dos Reis Rodrigues wrote: > > Hello guys, > > > > I implemented nfacctd acting as a Netflow collector using pmacct. It is > > working perfectly and writing the flows to a Kafka topic which I have an > > application processing it. > > > > Following is my configuration: > > > > kafka_topic: netflow > > kafka_broker_host: Kafka-host > > kafka_broker_port: 9092 > > kafka_refresh_time: 1 > > daemonize: true > > plugins: kafka > > pcap_interface: enp0s8 > > nfacctd_ip: 192.168.1.100 > > nfacctd_port: 9995 > > aggregate: src_host, dst_host, timestamp_start, timestamp_end, src_port, > > dst_port, proto > > > > Currently, there is only one Netflow exporter sending data to this > > demon and I would like to add another exporter. The problem is that I am > > not finding a way to differentiate the flows coming from different > > exporters. > > > > Let's say I have the exporter A currently sending data to nfacctd running > > at port 9995 and the data is being written to Kafka topic Netflow. > > > > Now I want a new exporter B to start sending data to nfacctd port 9996 > which > > will be running as a separate demon ( just because I though so, not sure > > yet if it is a necessary approach) and writing the data to the > > same Netflow topic in Kafka. > > > > When the data comes from Kafka to my application, I cannot tell from > > which exporter the data came from. I would need some sort of > identification > > in order to make this differentiation. It is important for me, because my > > application may treat differently Netflow traffic coming from these > > two Netflow exporters. > > > > Thanks in advance. > > > > Emanuel > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists >
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
