From owner-freebsd-questions@FreeBSD.ORG Fri Aug 9 09:04:52 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 33A5CDD3 for ; Fri, 9 Aug 2013 09:04:52 +0000 (UTC) (envelope-from c.kworr@gmail.com) Received: from mail-lb0-x230.google.com (mail-lb0-x230.google.com [IPv6:2a00:1450:4010:c04::230]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 6D564291E for ; Fri, 9 Aug 2013 09:04:51 +0000 (UTC) Received: by mail-lb0-f176.google.com with SMTP id w10so3107940lbi.35 for ; Fri, 09 Aug 2013 02:04:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; bh=0saDO8wa1jZJRgmMNhRnpBV1eyU5Bk6bzjvkXoRkzNI=; b=rz91j8byUhhyHmLyDw4IY+Fy86aHatqlghzwhh00pghzFMa/J4exeSI8DGBmh0tHO2 oOBJEba0J2RCeH5L7Gzd8f6oG7nXnEBfhGllhknsoyAc+0ycGqohuho4wDYb8sPO8Sjx EsKDRBWsDeYFfOALB1lpBaA4su0LlwxEmzE4cnnMkcYTmoeUELMwjGAnGiDpFp5LNbAM GhUJ9gZvgd1bzv4tpTeCMUAITnfocTYEZOTMJUF/gdwps1HIebBB8C9B7dh6WfXSOjfK 74BJFIU75jKSRgHFMJwMm8NtbUJ2m77P7MukLieITLTqTvp4Bi3kIwMUEpnDY18X2TxV Ph8w== X-Received: by 10.152.120.228 with SMTP id lf4mr5536412lab.44.1376039083811; Fri, 09 Aug 2013 02:04:43 -0700 (PDT) Received: from [192.168.1.128] (mau.donbass.com. [92.242.127.250]) by mx.google.com with ESMTPSA id w5sm6108600lbw.3.2013.08.09.02.04.42 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 09 Aug 2013 02:04:42 -0700 (PDT) Message-ID: <5204B0A9.8020508@gmail.com> Date: Fri, 09 Aug 2013 12:04:41 +0300 From: Volodymyr Kostyrko User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:17.0) Gecko/20130802 Thunderbird/17.0.7 MIME-Version: 1.0 To: freebsd-questions@freebsd.org Subject: if_bridge and ng_netflow Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2013 09:04:52 -0000 Hi all. I have one machine with bridge configured. Recently I thinked about capturing all traffic on the bridge with ng_netflow. 1. ng_ether doesn't attach to bridge0 interface: # ngctl list | grep ether Name: rl0 Type: ether ID: 00000034 Num hooks: 2 Name: ste0 Type: ether ID: 00000035 Num hooks: 2 Name: wlan0 Type: ether ID: 00000036 Num hooks: 2 2. If I attach all physical interfaces to netflow I get no statistics for data originating from server. I.e. I see all inbound traffic but I see no outbound traffic. Maybe I'm just doing everything wrong? I'm adding interfaces to netflow this way: connect wlan0: netflow0: upper iface2 connect wlan0: netflow0: lower iface3 connect netflow0: netflow0: out2 out3 3. Ok, I can do this other way (sorry, I'm bad at netflow scripting): mkpeer eiface ether ether rmhook ngeth0: ether ifconfig ngeth0 up ifconfig bridge0 span ngeth0 And again I see only inbound packets. I see no packets coming from me. Is there any other working way to get stats from bridge interface? -- Sphinx of black quartz, judge my vow.