ng_netflow

NAME

SYNOPSIS

DESCRIPTION

• RST or FIN TCP segment.
• Active timeout. Flows cannot live more than the specified period of time. The default is 1800 seconds (30 minutes).
• Inactive timeout. A flow was inactive for the specified period of time. The default is 15 seconds.

HOOKS

CONTROL MESSAGES

NGM_NETFLOW_INFO (info)

Returns some node statistics and the current timeout values in a struct ng_netflow_info.

NGM_NETFLOW_IFINFO (ifinfo)

Returns information about the ifaceN hook. The hook number is passed as an argument.

NGM_NETFLOW_SETDLT (setdlt)

Sets data link type on the ifaceN hook. Currently, supported types are DLT_RAW (raw IP datagrams) and DLT_EN10MB (Ethernet). DLT_ definitions can be found in <net/bpf.h> header. Currently used values are 1 for DLT_EN10MB and 12 for DLT_RAW. This message type uses struct ng_netflow_setdlt as an argument:

The requested ifaceN hook must already be connected, otherwise message send operation will return an error.

NGM_NETFLOW_SETIFINDEX (setifindex)

In some cases, ng_netflow may be unable to determine the input interface index of a packet. This can happen if traffic enters the ng_netflow node before it comes to the system interface's input queue. An example of such a setup is capturing a traffic between synchronous data line and ng_iface(4). In this case, the input index should be associated with a given hook. The interface's index can be determined via if_nametoindex(3) from userland. This message requires struct ng_netflow_setifindex as an argument:

The requested ifaceN hook must already be connected, otherwise the message send operation will return an error.

NGM_NETFLOW_SETTIMEOUTS (settimeouts)

Sets values in seconds for NetFlow active/inactive timeouts. This message requires struct ng_netflow_settimeouts as an argument:

NGM_NETFLOW_SETCONFIG (setconfig)

Sets configuration for the specified interface. This message requires struct ng_netflow_setconfig as an argument:

Configuration is a bitmask of several options. Option NG_NETFLOW_CONF_INGRESS enabled by default enables ingress NetFlow generation (for data coming from ifaceX hook). Option NG_NETFLOW_CONF_EGRESS enables egress NetFlow (for data coming from outX hook). Option NG_NETFLOW_CONF_ONCE defines that packet should be accounted only once if it several times passes via netflow node. Option NG_NETFLOW_CONF_THISONCE defines that packet should be accounted only once if it several times passes via exactly this netflow node. These two options are important to avoid duplicate accounting when both ingress and egress NetFlow are enabled. Option NG_NETFLOW_CONF_NOSRCLOOKUP skips radix lookup on flow source address used to fill in network mask. Option NG_NETFLOW_CONF_NODSTLOOKUP skips radix lookup on destination (which fills egress interface id, destination mask and gateway). If one doesn't need data provided by lookups, he/she can disable them, to reduce load on routers.

NGM_NETFLOW_SETTEMPLATE (settemplate)

Sets various timeouts to announce data flow templates (NetFlow v9-specific). This message requires struct ng_netflow_settemplate as an argument:

Value of time field represents time in seconds to re-announce data templates. Value of packets field represents maximum packets count between re-announcing data templates.

NGM_NETFLOW_SETMTU (setmtu)

Sets export interface MTU to build packets of specified size (NetFlow v9-specific). This message requires struct ng_netflow_setmtu as an argument:

Default is 1500 bytes.

NGM_NETFLOW_SHOW

This control message asks a node to dump the entire contents of the flow cache. It is called from flowctl(8), not directly from ngctl(8).

NGM_NETFLOW_V9INFO (v9info)

Returns some NetFlow v9 related values in a

SHUTDOWN

EXAMPLES

/usr/sbin/ngctl -f- <<-SEQ 
	mkpeer fxp0: netflow lower iface0 
	name fxp0:lower netflow 
	connect fxp0: netflow: upper out0 
	mkpeer netflow: ksocket export inet/dgram/udp 
	msg netflow:export connect inet/10.0.0.1:4444 
SEQ

/usr/sbin/ngctl -f- <<-SEQ 
	# connect ng0's tee to iface0 hook 
	mkpeer ng0:inet netflow right2left iface0 
	name ng0:inet.right2left netflow 
	# set DLT to raw mode 
	msg netflow: setdlt { iface=0 dlt=12 } 
	# set interface index (5 in this example) 
	msg netflow: setifindex { iface=0 index=5 } 
 
	# Connect fxp0: to iface1 and out1 hook 
	connect fxp0: netflow: lower iface1 
	connect fxp0: netflow: upper out1 
 
	# Create ksocket node on export hook, and configure it 
	# to send exports to proper destination 
	mkpeer netflow: ksocket export inet/dgram/udp 
	msg netflow:export connect inet/10.0.0.1:4444 
SEQ

SEE ALSO

AUTHORS

BUGS