Date: Thu, 9 Sep 2004 18:02:35 +0000 (UTC) From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: Andre Oppermann <andre@freebsd.org> Cc: net@freebsd.org Subject: Re: [TEST/REVIEW] Netflow implementation Message-ID: <Pine.BSF.4.53.0409091743120.51837@e0-0.zab2.int.zabbadoz.net> In-Reply-To: <414093DE.A6DC6E67@freebsd.org> References: <20040905121111.GA78276@cell.sick.ru> <4140834C.3000306@freebsd.org> <20040909171018.GA11540@cell.sick.ru> <414093DE.A6DC6E67@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 9 Sep 2004, Andre Oppermann wrote: > The only thing the kernel *may* know about is the right- and leftmost AS. > It may be more efficient to send the netflow data through a small helper > application that just fills in the two AS number based on a mrt dump. where and when ? that's not really possible I guess. Gleb currently sends the flows directly via a ksocket. Of course one could pass them to userspace but ... One would need sth like a "callback hook" into userspace to query a (routing) daemon before sending the flow. I once did an ugly posix local socket based lookup patch to zebra so traceroute could extract AS#s. and an extra hook, if connected ask the userspace daemon (be it the routing daemon or an intermediate) at the other end for the AS# once the flow starts and if you get an answer fill it in; if you don't leave it empty. What I'd like to ask but did not because I didn't really have a chance to view more than documentation is: - what is the memory impact of this node ? - can it cope with 50++ Mbit/s UDP worms scanning large subnets ? -- Bjoern A. Zeeb bzeeb at Zabbadoz dot NeT
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.53.0409091743120.51837>