From owner-freebsd-questions@FreeBSD.ORG  Mon Sep 20 07:29:49 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 055FC106566B;
	Mon, 20 Sep 2010 07:29:49 +0000 (UTC)
	(envelope-from eugene@imedia.ru)
Received: from lynx.imedia.ru (lynx.imedia.ru [83.242.167.254])
	by mx1.freebsd.org (Postfix) with ESMTP id 518EF8FC0C;
	Mon, 20 Sep 2010 07:29:47 +0000 (UTC)
X-All-Recipients: <freebsd-stable@freebsd.org><freebsd-questions@freebsd.org>
Received: from badger.imedia.ru (root@badger.imedia.ru [10.167.1.243])
	by lynx.imedia.ru (8.14.3/8.14.3/TWINS7_LDAP) with ESMTP id
	o8K7DQEc094535; Mon, 20 Sep 2010 11:13:26 +0400 (MSD)
	(envelope-from eugene@imedia.ru)
Received: from badger.imedia.ru (eugene@localhost [127.0.0.1])
	by badger.imedia.ru (8.14.3/8.13.1) with ESMTP id o8K7DQ9s077565;
	Mon, 20 Sep 2010 11:13:26 +0400 (MSD)
	(envelope-from eugene@imedia.ru)
Received: from localhost (localhost [[UNIX: localhost]])
	by badger.imedia.ru (8.14.3/8.13.8/Submit) id o8K7DO5I077564;
	Mon, 20 Sep 2010 11:13:24 +0400 (MSD)
	(envelope-from eugene@imedia.ru)
From: Eugene Mitrofanov <eugene@imedia.ru>
Organization: Independent Media Sanoma Magazines
To: freebsd-stable@freebsd.org, freebsd-questions@freebsd.org
Date: Mon, 20 Sep 2010 11:13:23 +0400
User-Agent: KMail/1.9.10
X-Origin: badger.imedia.ru
MIME-Version: 1.0
Content-Type: text/plain;
  charset="koi8-r"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <201009201113.24220.eugene@imedia.ru>
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0.1
	(lynx.imedia.ru [10.167.0.252]);
	Mon, 20 Sep 2010 11:13:26 +0400 (MSD)
X-Virus-Scanned: clamav-milter 0.96.2-exp at lynx.imedia.ru
X-Virus-Status: Clean
Cc: 
Subject: vlan + ng_ipfw + ng_netflow == no success
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Eugene Mitrofanov <eugene@imedia.ru>
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Sep 2010 07:29:49 -0000

Hello

I need the advise. Does anybody got the Subj working?

I have FreeBSD 7.3-p2, Generic kernel. I try to set up the netflow traffic 
accounting using ng_ipfw from vlan interface. I created vlan interface, ipfw 
rule, set up ng hooks but the netflow export is not working. tcpdump does 
not catch any packets to the collector. Any suggestion? Should I create the 
bug report?

- - - - - - - - 

# ifconfig vlan1 create vlan 1 vlandev fxp0 inet 192.168.1.1 netmask 
255.255.255.0

# ipfw add 10 ngtee 1 via vlan1

# ngctl -f - <<ENDL
mkpeer ipfw: netflow 1 iface0
name ipfw:1 netflow
msg netflow: setdlt { iface=0 dlt=12 }
msg netflow: setifindex { iface=0 index=7 }
mkpeer netflow: ksocket export inet/dgram/udp
msg netflow:export connect inet/10.167.1.252:2055
name netflow:export export
msg netflow: settimeouts { inactive = 60 active = 60 }
ENDL

# ping -c 5 192.168.1.254
PING 192.168.1.254 (192.168.1.254): 56 data bytes
64 bytes from 192.168.1.254: icmp_seq=0 ttl=255 time=0.672 ms
64 bytes from 192.168.1.254: icmp_seq=1 ttl=255 time=0.617 ms
64 bytes from 192.168.1.254: icmp_seq=2 ttl=255 time=0.658 ms
64 bytes from 192.168.1.254: icmp_seq=3 ttl=255 time=0.663 ms
64 bytes from 192.168.1.254: icmp_seq=4 ttl=255 time=0.681 ms

--- 192.168.1.254 ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.617/0.658/0.681/0.022 ms

# ipfw show                                                     
00010   10    840 ngtee 1 ip from any to any via vlan1

# tcpdump -n host 10.167.1.252 and port 2055
<nothing>

- - - - - - - 

Good luck
-- 
EMIT-RIPN, EVM7-RIPE