From owner-freebsd-net@FreeBSD.ORG Mon Feb 23 11:47:16 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EFDC016A4CE; Mon, 23 Feb 2004 11:47:16 -0800 (PST) Received: from cell.sick.ru (cell.sick.ru [217.72.144.68]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1642543D2D; Mon, 23 Feb 2004 11:47:16 -0800 (PST) (envelope-from glebius@cell.sick.ru) Received: from cell.sick.ru (glebius@localhost [127.0.0.1]) by cell.sick.ru (8.12.9/8.12.8) with ESMTP id i1NJknQE072686 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 23 Feb 2004 22:46:49 +0300 (MSK) (envelope-from glebius@cell.sick.ru) Received: (from glebius@localhost) by cell.sick.ru (8.12.9/8.12.6/Submit) id i1NJkmr2072685; Mon, 23 Feb 2004 22:46:49 +0300 (MSK) Date: Mon, 23 Feb 2004 22:46:48 +0300 From: Gleb Smirnoff To: Vasenin Alexander aka BlackSir Message-ID: <20040223194648.GB72475@cell.sick.ru> Mail-Followup-To: Gleb Smirnoff , Vasenin Alexander aka BlackSir , Julian Elischer , freebsd-isp@freebsd.org, "Bjoern A. Zeeb" , freebsd-net@freebsd.org References: <20040223104322.GA69982@cell.sick.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=koi8-r Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.6i cc: freebsd-isp@freebsd.org cc: "Bjoern A. Zeeb" cc: Julian Elischer cc: freebsd-net@freebsd.org Subject: Re: ng_netflow: testers are welcome X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Feb 2004 19:47:17 -0000 On Mon, Feb 23, 2004 at 10:32:42PM +0300, Vasenin Alexander aka BlackSir wrote: V> But there is bug in "ipfw tee" - packets is always immediately accepted V> instead of continue going through the ruleset, so tee must be the last V> rule(So, ng_netflow never see packets that denied by ipfw before tee rule). V> Maybe there is way to use 'divert'? I've tried - packets going to divert V> socket,then ng_netflow... and never come back... Actually I'm not quite V> understand mechanism of returning from divert - ng_ksocket have only one V> hook... This behavior of "ipfw tee" is even mentioned in BUGS. However there have been posted a fix in kern/61259. I have not tested it, you can try. Another way of solving "ipfw tee" problem would be writing a netgraph node with 2 hooks, first one sends received data back into itself and a copy towards second hook. ng_ksocket with divert should be connected to first hook, and ng_netflow to second one. You can call this node ng_echotee :) :))) When I typed it, I've understood that this behavior can be achieved combining ng_tee and ng_echo from base system. Really netgraph rocks! V> 2Gleb: It would be pleasure for me to write a little example based on our V> discussion for README if you need. I'd be glad if you show me your current netgraph setup script. Surely I can reproduce it myself, but live example would be better than imaginary. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE