From owner-freebsd-net@FreeBSD.ORG Thu Sep 9 18:05:11 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6A1E516A4CE; Thu, 9 Sep 2004 18:05:11 +0000 (GMT) Received: from transport.cksoft.de (transport.cksoft.de [62.111.66.27]) by mx1.FreeBSD.org (Postfix) with ESMTP id AA56C43D41; Thu, 9 Sep 2004 18:05:10 +0000 (GMT) (envelope-from bzeeb-lists@lists.zabbadoz.net) Received: from transport.cksoft.de (localhost [127.0.0.1]) by transport.cksoft.de (Postfix) with ESMTP id 781191FFDDB; Thu, 9 Sep 2004 20:05:08 +0200 (CEST) Received: by transport.cksoft.de (Postfix, from userid 66) id 486401FFDD6; Thu, 9 Sep 2004 20:05:06 +0200 (CEST) Received: by mail.int.zabbadoz.net (Postfix, from userid 1060) id 3D83E15389; Thu, 9 Sep 2004 18:02:34 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.int.zabbadoz.net (Postfix) with ESMTP id 326DE15384; Thu, 9 Sep 2004 18:02:35 +0000 (UTC) Date: Thu, 9 Sep 2004 18:02:35 +0000 (UTC) From: "Bjoern A. Zeeb" X-X-Sender: bz@e0-0.zab2.int.zabbadoz.net To: Andre Oppermann In-Reply-To: <414093DE.A6DC6E67@freebsd.org> Message-ID: References: <20040905121111.GA78276@cell.sick.ru> <4140834C.3000306@freebsd.org> <20040909171018.GA11540@cell.sick.ru> <414093DE.A6DC6E67@freebsd.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Virus-Scanned: by AMaViS cksoft-s20020300-20031204bz on transport.cksoft.de cc: Gleb Smirnoff cc: net@freebsd.org Subject: Re: [TEST/REVIEW] Netflow implementation X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Sep 2004 18:05:11 -0000 On Thu, 9 Sep 2004, Andre Oppermann wrote: > The only thing the kernel *may* know about is the right- and leftmost AS. > It may be more efficient to send the netflow data through a small helper > application that just fills in the two AS number based on a mrt dump. where and when ? that's not really possible I guess. Gleb currently sends the flows directly via a ksocket. Of course one could pass them to userspace but ... One would need sth like a "callback hook" into userspace to query a (routing) daemon before sending the flow. I once did an ugly posix local socket based lookup patch to zebra so traceroute could extract AS#s. and an extra hook, if connected ask the userspace daemon (be it the routing daemon or an intermediate) at the other end for the AS# once the flow starts and if you get an answer fill it in; if you don't leave it empty. What I'd like to ask but did not because I didn't really have a chance to view more than documentation is: - what is the memory impact of this node ? - can it cope with 50++ Mbit/s UDP worms scanning large subnets ? -- Bjoern A. Zeeb bzeeb at Zabbadoz dot NeT