Jump to content

netflow v5 - src AS/dst AS + ng_netflow netflow v5 - src AS/dst AS + ng_netflow

Hello, fellow posters,


As you can see from the subject, I'd like to set up a PC-based netflow

v5 probe, capable of exporting information about specific source and

destination ASes for the purpose of accounting. Regretfully, I

didnt come to any solution, mostly because the kernel FIB, eventhough

injected with a full BGP routing table, doesnt carry any BGP specific

information (such as next-hop AS, src AS, dst AS, etc.). This is

normal, because, at least the way I can explain it to myself, the BGP

speaking daemons, be it Zebra/Quagga, Xorp or OpenBGPd are userspace

programs and probably dont have a way to inject such information into

the kernel FIB, that's why keep it in its own structures.


My question is does any of you know of a way to achieve some sort of

interaction between the BGP-speaking daemon (e.g. Quagga) and the

various netflow probes to export Netflow v5 data, including

src/dst AS information.


Maybe some netgraph module besides ng_netflow, which I tried, but of no


Share this post

Link to post
Share on other sites

I know! Take sources and write the code. :)

Author of this project wrote:

The ng_netflow node type does not fill in AS numbers. This is due to the

lack of necessary information in the kernel routing table. However, this

information can be injected into the kernel from a routing daemon such as

GNU Zebra. This functionality may become available in future releases.


Еслиб кто-нибудь закомиттил, сам бы юзал...

Edited by Giga-Byte

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this