From owner-freebsd-isp@FreeBSD.ORG  Tue Feb 24 01:02:12 2004
Return-Path: <owner-freebsd-isp@FreeBSD.ORG>
Delivered-To: freebsd-isp@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 9E2C516A4CE; Tue, 24 Feb 2004 01:02:12 -0800 (PST)
Received: from cell.sick.ru (cell.sick.ru [217.72.144.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id C34EA43D1F; Tue, 24 Feb 2004 01:02:11 -0800 (PST)
	(envelope-from glebius@cell.sick.ru)
Received: from cell.sick.ru (glebius@localhost [127.0.0.1])
	by cell.sick.ru (8.12.9/8.12.8) with ESMTP id i1O91qQE076624
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Tue, 24 Feb 2004 12:01:53 +0300 (MSK)
	(envelope-from glebius@cell.sick.ru)
Received: (from glebius@localhost)
	by cell.sick.ru (8.12.9/8.12.6/Submit) id i1O91q3r076623;
	Tue, 24 Feb 2004 12:01:52 +0300 (MSK)
Date: Tue, 24 Feb 2004 12:01:52 +0300
From: Gleb Smirnoff <glebius@cell.sick.ru>
To: Vasenin Alexander aka BlackSir <blacksir@number.ru>
Message-ID: <20040224090152.GD76272@cell.sick.ru>
Mail-Followup-To: Gleb Smirnoff <glebius@cell.sick.ru>,
	Vasenin Alexander aka BlackSir <blacksir@number.ru>,
	freebsd-isp@freebsd.org,
	"Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>,
	Julian Elischer <julian@elischer.org>, freebsd-net@freebsd.org
References: <20040223194648.GB72475@cell.sick.ru>
	<NKEJKOHEKMBIMCCEHEPKOEDJCFAA.blacksir@number.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <NKEJKOHEKMBIMCCEHEPKOEDJCFAA.blacksir@number.ru>
User-Agent: Mutt/1.5.6i
cc: freebsd-isp@freebsd.org
cc: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
cc: Julian Elischer <julian@elischer.org>
cc: freebsd-net@freebsd.org
Subject: Re: ng_netflow: testers are welcome
X-BeenThere: freebsd-isp@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Internet Services Providers <freebsd-isp.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-isp>
List-Post: <mailto:freebsd-isp@freebsd.org>
List-Help: <mailto:freebsd-isp-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-isp>,
	<mailto:freebsd-isp-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Feb 2004 09:02:12 -0000

On Tue, Feb 24, 2004 at 10:46:44AM +0300, Vasenin Alexander aka BlackSir wrote:
V> > I'd be glad if you show me your current netgraph setup script. Surely
V> > I can reproduce it myself, but live example would be better than
V> > imaginary.
V> 
V> Here it is(latest version - 'echotee'):

Thanks for netgraph setup script. Could you please also send important parts
of your firewall config, where packets are diverted towards netgraph?
It is important to divert only _incoming_ traffic on _particular_ interface, 
otherwise netflow exports will contain some incorrect data.

V> This config assumes that packets needed to catch via ng_netflow is simply
V> diverted by ipfw rule:
V> divert 8888 ip from any to any in - or something like that
V> Seems everything works fine! (I'm using ipfw2 in 4.9) Packets going throught
V> divert and reinjected in ipfw ;-)
V> but I've not tested this in production yet...

And also it is important to check that ng_ksocket reinjects packet 
into the ipfw with rule number set (see Julian's mail).

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE