From owner-freebsd-net@FreeBSD.ORG Wed Apr 1 18:08:57 2015 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4C8D534A for ; Wed, 1 Apr 2015 18:08:57 +0000 (UTC) Received: from mail-lb0-x22c.google.com (mail-lb0-x22c.google.com [IPv6:2a00:1450:4010:c04::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id AFB2327F for ; Wed, 1 Apr 2015 18:08:56 +0000 (UTC) Received: by lbbug6 with SMTP id ug6so42450894lbb.3 for ; Wed, 01 Apr 2015 11:08:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=tQMaGfsDgDraiTEV1bxKSJj+v7PNo0YcTXfW00sT7x0=; b=sjgDf7JkRhckqaQLivNUEXINWpijozQyW2zcVS4qrsfGlQRA6aNDoOK+CrO8qog83F MHcpBgkWy66JAxObkyBMLTWfCvE/j+pF974CiPtrp5QvWA7S9xmbbc+2mQLbOyUSU/NK e0H3yy3mF1AcvmizjeOsWgIOq6AIOG5xgq2BgUgNsNxvPUel51vqQwvMibzbXioLM8S6 32LSy5L/zUVt/kdGbiEdySO7m3h/3aHoVrowPWhYAbfLFX++2ZXEU3re0/OjNdhLYu6I LXVfpHl2Sf7zbIpBa1f1dqtPez5rZL8tq19zpoZ5XRqQyWqCIh8j7WkfMwROuWwpgzga +DDw== MIME-Version: 1.0 X-Received: by 10.112.63.165 with SMTP id h5mr36345786lbs.16.1427911734890; Wed, 01 Apr 2015 11:08:54 -0700 (PDT) Sender: ndenev@gmail.com Received: by 10.112.130.231 with HTTP; Wed, 1 Apr 2015 11:08:54 -0700 (PDT) In-Reply-To: <20150401.115048.1362042954044146751.wwaites@tardis.ed.ac.uk> References: <20150401.115048.1362042954044146751.wwaites@tardis.ed.ac.uk> Date: Wed, 1 Apr 2015 20:08:54 +0200 X-Google-Sender-Auth: 8Q7mF8fly5IAxzrsgFeW2Wgl7sw Message-ID: Subject: Re: ng_netgraph and BGP From: Nikolay Denev To: William Waites Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: "freebsd-net@freebsd.org" X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Apr 2015 18:08:57 -0000 On Wed, Apr 1, 2015 at 12:50 PM, William Waites wrote: > I run a small network composed of even smaller networks each > encapsulated in an autonomous system. I'd like to do traffic > accounting using netflow aggregated by ASN. My border routers run > FreeBSD and BIRD. > > Right now, and this is mentioned in ng_netflow(4), we do not fill in > the source and destination ASN because there is no information to get > this from the routing daemon's RIB. Probably if we come up with such a > way it should be generic so it could be used by Quagga, BIRD or > OpenBGPD. > > I've done a little bit of thinking about how this could be done, and > come up with two main strategies: > > 1. A new kind of netgraph node inserted before ng_netflow knows how > to query the routing daemon and decorates the packet with the > result, which ng_netflow then puts into the flow packet if > present. This entails either a copy (tee) or putting the lookup > in the data path which may be suboptimal. > > 2. A new hook added to the ng_netflow node that allows it to query > the routing daemon through a different new kind of netgraph > node. This is probably better but may be slightly more > complicated to implement. > > Is anyone working on this or has given this though? I wasn't able to > find much by searching the list archives. It may be that I will soon > have some students that I can set on this task but would not like to > unnecessarily duplicate effort. > > Cheers, > -w > > -- > William Waites | School of Informatics > http://tardis.ed.ac.uk/~wwaites/ | University of Edinburgh > http://www.hubs.net.uk/ | HUBS AS60241 > > The University of Edinburgh is a charitable body, registered in > Scotland, with registration number SC005336. > Hi, It's not ng_netflow, but if you need this today you can take a look at http://www.pmacct.net ? (there is a package/port too). It comes with BGP daemon (stripped down quagga) and can export this data. --Nikolay