From owner-freebsd-questions@FreeBSD.ORG  Sat Aug 10 13:51:28 2013
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id AC9F16FD
 for <freebsd-questions@freebsd.org>; Sat, 10 Aug 2013 13:51:28 +0000 (UTC)
 (envelope-from fbsd8@a1poweruser.com)
Received: from mailch-2.name-services.com (mailch-2.name-services.com
 [98.124.252.184])
 by mx1.freebsd.org (Postfix) with ESMTP id 97B582D37
 for <freebsd-questions@freebsd.org>; Sat, 10 Aug 2013 13:51:28 +0000 (UTC)
Received: from mailch.name-services.com (localhost [127.0.0.1])
 by mailch.name-services.com (Postfix) with SMTP id CA88E630BB8;
 Sat, 10 Aug 2013 06:51:24 -0700 (PDT)
X-Sender-Id: 173.88.196.224
Received: from mail-24.name-services.com (sjl0vwsmail09.prod.dm.local
 [10.7.17.59]) by 0.0.0.0:2500 (trex/4.8.23);
 Sat, 10 Aug 2013 13:51:24 GMT
X-Pool-Id: 3
Received: from [10.0.10.1] (cpe-173-88-196-224.neo.res.rr.com
 [173.88.196.224]) by mail-24.name-services.com with SMTP; 
 Sat, 10 Aug 2013 06:51:16 -0700
Message-ID: <522F23D5.60909@a1poweruser.com>
From: Fbsd8 <fbsd8@a1poweruser.com>
User-Agent: Thunderbird 2.0.0.17 (Windows/20080914)
MIME-Version: 1.0
To: Volodymyr Kostyrko <c.kworr@gmail.com>
Subject: Re: if_bridge and ng_netflow
References: <5204B0A9.8020508@gmail.com>
In-Reply-To: <5204B0A9.8020508@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-questions@freebsd.org
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
Date: Sat, 10 Aug 2013 13:51:28 -0000
X-Original-Date: Tue, 10 Sep 2013 09:51:17 -0400
X-List-Received-Date: Sat, 10 Aug 2013 13:51:28 -0000

Volodymyr Kostyrko wrote:
> Hi all.
> 
> I have one machine with bridge configured. Recently I thinked about 
> capturing all traffic on the bridge with ng_netflow.
> 
> 1. ng_ether doesn't attach to bridge0 interface:
> 
> # ngctl list | grep ether
>   Name: rl0             Type: ether           ID: 00000034   Num hooks: 2
>   Name: ste0            Type: ether           ID: 00000035   Num hooks: 2
>   Name: wlan0           Type: ether           ID: 00000036   Num hooks: 2
> 
> 2. If I attach all physical interfaces to netflow I get no statistics 
> for data originating from server. I.e. I see all inbound traffic but I 
> see no outbound traffic.
> 
> Maybe I'm just doing everything wrong? I'm adding interfaces to netflow 
> this way:
> 
>     connect wlan0: netflow0: upper iface2
>     connect wlan0: netflow0: lower iface3
>     connect netflow0: netflow0: out2 out3
> 
> 3. Ok, I can do this other way (sorry, I'm bad at netflow scripting):
> 
> mkpeer eiface ether ether
> rmhook ngeth0: ether
> 
> ifconfig ngeth0 up
> ifconfig bridge0 span ngeth0
> 
> And again I see only inbound packets. I see no packets coming from me.
> 
> Is there any other working way to get stats from bridge interface?
> 


if_bridge is relatively new in FreeBSD. Netgraph precedes if_bridge and 
is un-aware of if_bridge. Change your if_bridge definition to a
ng bridge definition and everything your trying to do should fall into 
place.