From owner-freebsd-stable@FreeBSD.ORG  Thu Jun 13 01:25:23 2013
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id 522E5A82;
 Thu, 13 Jun 2013 01:25:23 +0000 (UTC)
 (envelope-from doconnor@gsoft.com.au)
Received: from cain.gsoft.com.au (cain.gsoft.com.au [203.31.81.10])
 by mx1.freebsd.org (Postfix) with ESMTP id D65A81EA1;
 Thu, 13 Jun 2013 01:25:22 +0000 (UTC)
Received: from ur.gsoft.com.au (Ur.gsoft.com.au [203.31.81.55])
 (authenticated bits=0)
 by cain.gsoft.com.au (8.14.4/8.14.3) with ESMTP id r5D1PEpq086218
 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO);
 Thu, 13 Jun 2013 10:55:19 +0930 (CST)
 (envelope-from doconnor@gsoft.com.au)
Subject: Re: Flow monitoring with PF
Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\))
Content-Type: text/plain; charset=iso-8859-1
From: "Daniel O'Connor" <doconnor@gsoft.com.au>
In-Reply-To: <CAPBZQG1RqjP3kv4BjnQZr-khVXq1E-6cqdDOnqFsn4bBp_2OCw@mail.gmail.com>
Date: Thu, 13 Jun 2013 10:55:13 +0930
Content-Transfer-Encoding: quoted-printable
Message-Id: <65D8AD99-A3F6-43EA-94AF-EFFE81583AEB@gsoft.com.au>
References: <CAPBZQG1RqjP3kv4BjnQZr-khVXq1E-6cqdDOnqFsn4bBp_2OCw@mail.gmail.com>
To: =?iso-8859-1?Q?Ermal_Lu=E7i?= <eri@freebsd.org>
X-Mailer: Apple Mail (2.1508)
X-Spam-Score: -3.052 () ALL_TRUSTED,BAYES_00,RP_MATCHES_RCVD
X-Scanned-By: MIMEDefang 2.67 on 203.31.81.10
Cc: freebsd-stable@freebsd.org
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
 <mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 Jun 2013 01:25:23 -0000


On 13/06/2013, at 3:06, Ermal Lu=E7i <eri@freebsd.org> wrote:
>> I was looking at trying out flow monitoring and I found pfflowd, but =
unfortunately it does not work with FreeBSD >9.0. I thought about =
ng_netflow but that doesn't see my tun interface which may be related =
to..
>> WARNING: attempt to domain_add(netgraph) after domainfinalize()
>>=20
>> since tun0 appears after the kernel is all done.
>>=20
>> Does anyone have any recommendations for generating flow information =
from PF?
>>=20
> Here =
https://github.com/pfsense/pfsense-tools/tree/master/pfPorts/pfflowd-0.8
> is a port that should work ok with pf(4) in FreeBSD 9.0++

Ahh very nice, thanks!

--
Daniel O'Connor software and network engineer
for Genesis Software - http://www.gsoft.com.au
"The nice thing about standards is that there
are so many of them to choose from."
  -- Andrew Tanenbaum
GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C