Date: Mon, 23 Feb 2004 22:32:42 +0300 From: "Vasenin Alexander aka BlackSir" <blacksir@number.ru> To: "Gleb Smirnoff" <glebius@cell.sick.ru>, "Julian Elischer" <julian@elischer.org> Cc: freebsd-net@freebsd.org Subject: RE: ng_netflow: testers are welcome Message-ID: <NKEJKOHEKMBIMCCEHEPKAECNCFAA.blacksir@number.ru> In-Reply-To: <20040223104322.GA69982@cell.sick.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
YES! IT WORKS!
All I've need - just create ksocket with inet/rawip/divert hook connected to
ng_netflow iface0 hook (mkpeer netflow: ksocket iface0 inet/raw/divert),
then "msg netflow: setdlt { iface=0 dlt=12 }" (Raw ip instead of ethernet),
then "msg divert: bind inet/0.0.0.0:8888". And after all add ipfw rule "tee
8888 ip from any to any in"(One may need "via $oif") instead of final allow
(or, better, before it).
But there is bug in "ipfw tee" - packets is always immediately accepted
instead of continue going through the ruleset, so tee must be the last
rule(So, ng_netflow never see packets that denied by ipfw before tee rule).
Maybe there is way to use 'divert'? I've tried - packets going to divert
socket,then ng_netflow... and never come back... Actually I'm not quite
understand mechanism of returning from divert - ng_ksocket have only one
hook...
Great thanks to Julian & Gleb & all who helped!
2Gleb: It would be pleasure for me to write a little example based on our
discussion for README if you need.
Vasenin Alexander aka BlackSir
> -----Original Message-----
> From: owner-freebsd-isp@freebsd.org
> [mailto:owner-freebsd-isp@freebsd.org]On Behalf Of Gleb Smirnoff
> Sent: Monday, February 23, 2004 1:43 PM
> To: Julian Elischer
> Cc: freebsd-isp@freebsd.org; Bjoern A. Zeeb; Vasenin Alexander aka
> BlackSir; freebsd-net@freebsd.org
> Subject: Re: ng_netflow: testers are welcome
> On Sun, Feb 22, 2004 at 03:17:38PM -0800, Julian Elischer wrote:
> J> you can open a divert socket as a netgraph node by openning a ksocket
> J> node with protocol 'divert'.
> Really one can use "ipfw tee" to pass demasqueraded traffic to
> ng_netflow.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?NKEJKOHEKMBIMCCEHEPKAECNCFAA.blacksir>