From owner-freebsd-net@FreeBSD.ORG  Tue Feb 19 18:06:33 2013
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id 6386626E
 for <freebsd-net@freebsd.org>; Tue, 19 Feb 2013 18:06:33 +0000 (UTC)
 (envelope-from adrian.chadd@gmail.com)
Received: from mail-wi0-f172.google.com (mail-wi0-f172.google.com
 [209.85.212.172]) by mx1.freebsd.org (Postfix) with ESMTP id 04B39A9A
 for <freebsd-net@freebsd.org>; Tue, 19 Feb 2013 18:06:32 +0000 (UTC)
Received: by mail-wi0-f172.google.com with SMTP id ez12so5173354wid.5
 for <freebsd-net@freebsd.org>; Tue, 19 Feb 2013 10:06:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:x-received:sender:in-reply-to:references:date
 :x-google-sender-auth:message-id:subject:from:to:cc:content-type;
 bh=K/2S3KA8UrUqq9YGhe1g88sBKxgZuDZzPwy/ztxwv5I=;
 b=JgQ04rzsxDk2Iktrl6y+PVIo3OyWiESc0PQtdtIsFUGqCC1e0bETMRIKH6j7R+sMiP
 J2NlYZqZ+N7yB/3lcTZ24fChWhTNxTCczqTDQDTWrumTtRj4AcLsXGxpyc9s2i5e0FnE
 FF83+hYwhV1FtyzzEJMq+TiYD7hbL1NOrN0ZMUkKlAJxwu77LJUSNQJZctmxzosrnSdg
 WtaVszUZ0L4zTZKOp3XG57dVWT+EMXi629hpkmZe3wYFMniaoI7zwJzJq1MMTG9jaK0H
 orb81VKsKxnvuHohlfA0JOHB8QR1r1+3EbLbslStS9qCmFaDFLr+nTjo1nmTmPC9pOiN
 +2Rg==
MIME-Version: 1.0
X-Received: by 10.194.108.101 with SMTP id hj5mr28500718wjb.6.1361297192246;
 Tue, 19 Feb 2013 10:06:32 -0800 (PST)
Sender: adrian.chadd@gmail.com
Received: by 10.216.236.88 with HTTP; Tue, 19 Feb 2013 10:06:32 -0800 (PST)
In-Reply-To: <5123B726.5030403@seznam.cz>
References: <512358BB.1040609@seznam.cz>
 <CAJ-VmonThLc2oi=9bEYbda+N_qOk0Ng9Xfx_wu5SDe+8L+9daw@mail.gmail.com>
 <5123B726.5030403@seznam.cz>
Date: Tue, 19 Feb 2013 10:06:32 -0800
X-Google-Sender-Auth: uHPsnzOUFGRiW5yta463FzC5Ymo
Message-ID: <CAJ-Vmonyyobo6nchRxQBm=weEQU6XedkU3+KHEFXQvWmOeJP-g@mail.gmail.com>
Subject: Re: Netflow v9 with ng_netflow and nfdump
From: Adrian Chadd <adrian@freebsd.org>
To: Jan Markus <markus.jan@seznam.cz>
Content-Type: text/plain; charset=ISO-8859-1
Cc: freebsd-net@freebsd.org
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 19 Feb 2013 18:06:33 -0000

Ok. well, as long as you're situated in a place that lets you see the
MAC addresses, you should be ok. You just need to hack the netflow
module to include the source/destination mac address.



adrian