Date: Mon, 23 Feb 2004 22:46:48 +0300 From: Gleb Smirnoff <glebius@cell.sick.ru> To: Vasenin Alexander aka BlackSir <blacksir@number.ru> Cc: freebsd-net@freebsd.org Subject: Re: ng_netflow: testers are welcome Message-ID: <20040223194648.GB72475@cell.sick.ru> In-Reply-To: <NKEJKOHEKMBIMCCEHEPKAECNCFAA.blacksir@number.ru> References: <20040223104322.GA69982@cell.sick.ru> <NKEJKOHEKMBIMCCEHEPKAECNCFAA.blacksir@number.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Feb 23, 2004 at 10:32:42PM +0300, Vasenin Alexander aka BlackSir wrote: V> But there is bug in "ipfw tee" - packets is always immediately accepted V> instead of continue going through the ruleset, so tee must be the last V> rule(So, ng_netflow never see packets that denied by ipfw before tee rule). V> Maybe there is way to use 'divert'? I've tried - packets going to divert V> socket,then ng_netflow... and never come back... Actually I'm not quite V> understand mechanism of returning from divert - ng_ksocket have only one V> hook... This behavior of "ipfw tee" is even mentioned in BUGS. However there have been posted a fix in kern/61259. I have not tested it, you can try. Another way of solving "ipfw tee" problem would be writing a netgraph node with 2 hooks, first one sends received data back into itself and a copy towards second hook. ng_ksocket with divert should be connected to first hook, and ng_netflow to second one. You can call this node ng_echotee :) :))) When I typed it, I've understood that this behavior can be achieved combining ng_tee and ng_echo from base system. Really netgraph rocks! V> 2Gleb: It would be pleasure for me to write a little example based on our V> discussion for README if you need. I'd be glad if you show me your current netgraph setup script. Surely I can reproduce it myself, but live example would be better than imaginary. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040223194648.GB72475>