Date: Tue, 19 Feb 2013 08:21:49 -0800 (PST) From: Barney Cordoba <barney_cordoba@yahoo.com> To: freebsd-net@freebsd.org, erichsfreebsdlist <erichsfreebsdlist@alogt.com>, linimon <linimon@FreeBSD.org>, freebsd-isp@freebsd.org, khatfield <khatfield@socllc.net>, squid-users-subscribe@squid-cache.org, friends <friends@foxnews.com>, freebsd-current@freebsd.org Subject: Barney Cordoba Message-ID: <1361290909.39265.YahooMailNeo@web121603.mail.ne1.yahoo.com>
next in thread | raw e-mail | index | archive | help
http://www.bauer-mc.de/llcfkrr/t2cx3elzyvfq/h6k5gxkn8vwjj2dvpf From owner-freebsd-net@FreeBSD.ORG Tue Feb 19 17:02:23 2013 Return-Path: <owner-freebsd-net@FreeBSD.ORG> Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 75494EBD for <freebsd-net@freebsd.org>; Tue, 19 Feb 2013 17:02:23 +0000 (UTC) (envelope-from adrian.chadd@gmail.com) Received: from mail-wg0-f47.google.com (mail-wg0-f47.google.com [74.125.82.47]) by mx1.freebsd.org (Postfix) with ESMTP id 14E3764B for <freebsd-net@freebsd.org>; Tue, 19 Feb 2013 17:02:22 +0000 (UTC) Received: by mail-wg0-f47.google.com with SMTP id dr13so5545348wgb.26 for <freebsd-net@freebsd.org>; Tue, 19 Feb 2013 09:02:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=z0WDLfXNWSFCV2uaO33IC6KQMFS04qOESUyv+jO3RSY=; b=CBg4SwkTDd0MM1sJfEJhj8Wx37EiH94oPbSa1S7VkRhPJv5e8SdmH3DohReDGJj0rZ aBFoRCDzobXsuRxoqoTPn2VkZgGX8iNMQtxb8BhXC6SeH4s8mGga1jjqvvL1uICRx1q+ KGL9F/ZElnw7GtdnIPz9dTg57pJdgtkH4sxG/p3cnRQ1Z1JHv+XHin6Sh02K30IWeEky yZNWakPaJF6hwTdYsCwk66SULh2BlhoCUmbdKvQJVRg8Dy7hh3SYwGtOyzIXJcF6H2GO mw6eZInZ+9Qd5RNHbb7y61z3wMQZLZ7Ar9qvJaSPmxeNbC0BaW6GdOIEzuy75acBeLlA d/OQ== MIME-Version: 1.0 X-Received: by 10.180.93.234 with SMTP id cx10mr28856826wib.34.1361293335916; Tue, 19 Feb 2013 09:02:15 -0800 (PST) Sender: adrian.chadd@gmail.com Received: by 10.216.236.88 with HTTP; Tue, 19 Feb 2013 09:02:15 -0800 (PST) In-Reply-To: <512358BB.1040609@seznam.cz> References: <512358BB.1040609@seznam.cz> Date: Tue, 19 Feb 2013 09:02:15 -0800 X-Google-Sender-Auth: _U09twirOqJf-siiHxQ73V1cZ4I Message-ID: <CAJ-VmonThLc2oi=9bEYbda+N_qOk0Ng9Xfx_wu5SDe+8L+9daw@mail.gmail.com> Subject: Re: Netflow v9 with ng_netflow and nfdump From: Adrian Chadd <adrian@freebsd.org> To: Jan Markus <markus.jan@seznam.cz> Content-Type: text/plain; charset=ISO-8859-1 Cc: freebsd-net@freebsd.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org> List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>, <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe> List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>; List-Post: <mailto:freebsd-net@freebsd.org> List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help> List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>, <mailto:freebsd-net-request@freebsd.org?subject=subscribe> X-List-Received-Date: Tue, 19 Feb 2013 17:02:23 -0000 .. I assume that your netflow collector is positioned correctly so it can see the actual client MAC, rather than the MAC of the L3 gateway device? adrian On 19 February 2013 02:49, Jan Markus <markus.jan@seznam.cz> wrote: > Hello, > > our Ministry of the interior now requires that IP traffic logs must contain > MAC addresses of our clients. I am trying to fulfil this with Netflow v9 > which (allegedly) should contain the MAC addresses of IP flows. > > But with no success so far... > > We have a mirror port on our core switch and capture the VLAN tagged packets > on em1 NIC on our FreeBSD 9.1 server. > > Our netflow collector is configured like this: > > kldload ng_ether > kldload ng_ksocket > kldload ng_netflow > > ifconfig em1 promisc -arp up > > ngctl mkpeer em1: netflow lower iface0 > ngctl name em1:lower netflow > ngctl connect em1: netflow: upper out0 > ngctl mkpeer netflow: ksocket export9 inet/dgram/udp > ngctl msg netflow:export9 connect inet/127.0.0.1:9995 > > We capture the netflow packets on the same machine like this: > > nfcapd -p 9995 -S 2 -T all -D -l ./ > > But when I try to get the log like this: > > nfdump -r nfcapd.201302191051 > nfcapd.201302191051.out > > All I get is date, protocol, src and dst IP and port, and number of bytes, > packets and flows. No information on MAC addresses whatsoever. > > What am I doing wrong? > > Thank you very much for your help, > -Jan > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1361290909.39265.YahooMailNeo>