Date: Fri, 3 Apr 2015 17:38:21 +0300 From: Gleb Smirnoff <glebius@FreeBSD.org> To: William Waites <wwaites@tardis.ed.ac.uk> Cc: freebsd-net@freebsd.org Subject: Re: ng_netgraph and BGP Message-ID: <20150403143821.GY64665@FreeBSD.org> In-Reply-To: <20150401.115048.1362042954044146751.wwaites@tardis.ed.ac.uk> References: <20150401.115048.1362042954044146751.wwaites@tardis.ed.ac.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Apr 01, 2015 at 11:50:48AM +0100, William Waites wrote: W> I run a small network composed of even smaller networks each W> encapsulated in an autonomous system. I'd like to do traffic W> accounting using netflow aggregated by ASN. My border routers run W> FreeBSD and BIRD. W> W> Right now, and this is mentioned in ng_netflow(4), we do not fill in W> the source and destination ASN because there is no information to get W> this from the routing daemon's RIB. Probably if we come up with such a W> way it should be generic so it could be used by Quagga, BIRD or W> OpenBGPD. W> W> I've done a little bit of thinking about how this could be done, and W> come up with two main strategies: W> W> 1. A new kind of netgraph node inserted before ng_netflow knows how W> to query the routing daemon and decorates the packet with the W> result, which ng_netflow then puts into the flow packet if W> present. This entails either a copy (tee) or putting the lookup W> in the data path which may be suboptimal. W> W> 2. A new hook added to the ng_netflow node that allows it to query W> the routing daemon through a different new kind of netgraph W> node. This is probably better but may be slightly more W> complicated to implement. W> W> Is anyone working on this or has given this though? I wasn't able to W> find much by searching the list archives. It may be that I will soon W> have some students that I can set on this task but would not like to W> unnecessarily duplicate effort. The issue is open since I've written the ng_netflow node. You would agree that keeping the ASN information in kernel, just for the sake of exporting it out, is rather strange. Anyway, in 2004 I've written a patch to ng_netflow, rtsock and quagga to do that. But it didn't went into FreeBSD for the above reasons. Also, it required changing the rtsock API. You may try to search for the patch in internet archives. But the proper solution, I think, is to do prefix -> ASN matching at the collector. Or, if you cannot modify the collector, you can create a proxy collector that is feeded data from ng_netflow and resends it to collector with ASN filled in. You can put the proxy on the machine that runs either ng_netflow, or the collector. -- Totus tuus, Glebius.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150403143821.GY64665>