Re: NetFlow / sFlow / IPFIX network probe proposal

[Holger Eitzenberger <holger@eitzenberger.org>]

(replying by private mail)

Hi,

> > Thank you for pointing it out, I didn't know about conntrack support in ulogd.
> > 
> > As far as I understood, IPFIX output in ulogd is in a early stage and
> > don't work. So, I tested ulogd + ctnetlink with null output and it
> > worked very well.

I've done an IPFIX implementation a few months ago for ulogd2, but it
currently is of prototype character only, as it only implements IPFIX
over UDP, but SCTP and possibly TCP (+ SSL) are required for a
conforming implementation.  I use the "bi-flow" approach of RFC 51303,
but it shouldn't be a problem at all to have it support the single
direction flow approach instead from RFC 5101/5102.

In general ctnetlink is not a problem here from a performance standpoint,
and I think there is no need for doing that in kernel space.

Some bits and pieces may be missing on the kernel side if you need to
classify your flows though.  E. g. some IPFIX Aggregrators require the
DSCP value for that.

> Accounting is done in kernel space by conntrack, but aggregation should
> be done in userspace in my opinion. I don't think you need a lot of
> optimization, AFAIK Holger's patches already scale to large setups
> very well.

I have setups with hundreds of thounsands of flows, and it accounts
quite well :).

Hope that helps a bit.

 /holger