netflow v5 - src AS/dst AS + ng_netflow

[piston]

Hello, fellow posters,

 

As you can see from the subject, I'd like to set up a PC-based netflow

v5 probe, capable of exporting information about specific source and

destination ASes for the purpose of accounting. Regretfully, I

didnt come to any solution, mostly because the kernel FIB, eventhough

injected with a full BGP routing table, doesnt carry any BGP specific

information (such as next-hop AS, src AS, dst AS, etc.). This is

normal, because, at least the way I can explain it to myself, the BGP

speaking daemons, be it Zebra/Quagga, Xorp or OpenBGPd are userspace

programs and probably dont have a way to inject such information into

the kernel FIB, that's why keep it in its own structures.

 

My question is does any of you know of a way to achieve some sort of

interaction between the BGP-speaking daemon (e.g. Quagga) and the

various netflow probes to export Netflow v5 data, including

src/dst AS information.

 

Maybe some netgraph module besides ng_netflow, which I tried, but of no

avail.

[Giga-Byte]

I know! Take sources and write the code. :)

Author of this project wrote:

The ng_netflow node type does not fill in AS numbers. This is due to the

lack of necessary information in the kernel routing table. However, this

information can be injected into the kernel from a routing daemon such as

GNU Zebra. This functionality may become available in future releases.

 

Еслиб кто-нибудь закомиттил, сам бы юзал...

Edited March 21, 2009 by Giga-Byte