From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Donovan <doohara@cisco.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: additional conntrack feature
Date: Fri, 18 Apr 2014 22:02:54 +0200 [thread overview]
Message-ID: <20140418200254.GA5417@localhost> (raw)
In-Reply-To: <535046D9.3020602@cisco.com>
On Thu, Apr 17, 2014 at 05:25:45PM -0400, Donovan wrote:
> Hi,
>
> We are writing Proof Of Concept (POC) code to export (send) enhanced
> NetFlow based on conntrack events.
I guess you refer to IPFIX? We got some recent patches to get it
working in ulogd2.
> We've added some new minimal functionality to the kernel socket and
> netfilter-conntrack code. This provides new information in the
> events as can be viewed by the conntrack program.
>
> We would like to send NetFlow based on the conntrack events and were
> wondering where to place such functionality. We would like such
> NetFlow to be sent by a service or daemon and we would like for this
> functionality to become open source. We have some questions:
> - Would it be acceptable to enhance conntrack-tools to send this NetFlow?
> - Like for instance placing it in the conntrackd daemon?
> - Or would it be OK to provide a new program alongside conntrack and
> conntrackd or the conntrack-tools to do this?
ulogd2 is the logging netfilter stub, so it's the right framework for
logging extensions IMO.
prev parent reply other threads:[~2014-04-18 20:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-17 21:25 additional conntrack feature Donovan
2014-04-18 20:02 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140418200254.GA5417@localhost \
--to=pablo@netfilter.org \
--cc=doohara@cisco.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).