From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Weimer Subject: Re: NetFlow / sFlow / IPFIX network probe proposal Date: Thu, 08 Apr 2010 14:55:55 +0000 Message-ID: <82k4singck.fsf@mid.bfk.de> References: Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: (Roman Tsisyk's message of "Tue\, 30 Mar 2010 21\:06\:57 +0700") Sender: linux-net-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="macroman" To: Roman Tsisyk Cc: netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org, linux-net@vger.kernel.org * Roman Tsisyk: > 2. Correctly and fully fill all fields in a packet > As I pointed above, pcap-based tools can't correctly fill all fields, > e.g. output interface, nexthop, and AS (but I don't know where get AS > information in the kernel yet). (Older) IOS populates those fields from route tags found in the FIB. Quagga etc. would have to be taught to set these tags. The advantage is that no additional route lookups are required (at least when rp_filter is active). --=20 =46lorian Weimer BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstra=DFe 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Weimer Subject: Re: NetFlow / sFlow / IPFIX network probe proposal Date: Thu, 08 Apr 2010 14:55:55 +0000 Message-ID: <82k4singck.fsf@mid.bfk.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Cc: netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org, linux-net@vger.kernel.org To: Roman Tsisyk Return-path: In-Reply-To: (Roman Tsisyk's message of "Tue\, 30 Mar 2010 21\:06\:57 +0700") Sender: linux-net-owner@vger.kernel.org List-Id: netfilter-devel.vger.kernel.org * Roman Tsisyk: > 2. Correctly and fully fill all fields in a packet > As I pointed above, pcap-based tools can't correctly fill all fields, > e.g. output interface, nexthop, and AS (but I don't know where get AS > information in the kernel yet). (Older) IOS populates those fields from route tags found in the FIB. Quagga etc. would have to be taught to set these tags. The advantage is that no additional route lookups are required (at least when rp_filter is active). --=20 =46lorian Weimer BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstra=DFe 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99