From kiwi at oav.net  Sat May  6 06:07:07 2006
From: kiwi at oav.net (Xavier Beaudouin)
Date: Fri, 5 May 2006 22:07:07 +0200
Subject: [netflow-tools] pfflowd and core routing
Message-ID: <4833E50D-F9BA-457A-9292-08C95BB14B1C@oav.net>

Hi there,

I use a lot openbgpd as core routers (I don't have yet the money to  
have hardware routers that support bgp).

I want to monitor using nfsen for example the flow I get on my  
network with a minimal cpu overhead.

What is the minimal pf configuration to make to have full pfflowd  
sending correct flows ?

Thanks :)

/Xavier



From djm at mindrot.org  Sat May  6 19:15:48 2006
From: djm at mindrot.org (Damien Miller)
Date: Sat, 6 May 2006 19:15:48 +1000 (EST)
Subject: [netflow-tools] pfflowd and core routing
In-Reply-To: <4833E50D-F9BA-457A-9292-08C95BB14B1C@oav.net>
References: <4833E50D-F9BA-457A-9292-08C95BB14B1C@oav.net>
Message-ID: <Pine.BSO.4.64.0605061914140.541@fuyu.mindrot.org>

On Fri, 5 May 2006, Xavier Beaudouin wrote:

> I want to monitor using nfsen for example the flow I get on my  
> network with a minimal cpu overhead.
> 
> What is the minimal pf configuration to make to have full pfflowd  
> sending correct flows ?

pass all keep state

You might want to limit this to a particular NIC(s):

pass all on { em0, em1 } keep state




From duong at mail.nih.gov  Thu May 18 03:43:10 2006
From: duong at mail.nih.gov (Duong, Dat (NIH/CIT) [E])
Date: Wed, 17 May 2006 13:43:10 -0400
Subject: [netflow-tools] PF_Ring and softflowd
Message-ID: <71B0C9CB1FF4EA43BB48C08DCFF1A1FF077EB58D@NIHCESMLBX.nih.gov>

Hello,


On a Linux platform, would PF_Ring kernel patch help the performance of
softflowd. I'm interested to see if I can handle 1Gbit link with the
'right sized box'

 

Thanks,

 

 

 



From h4w301 at gmail.com  Wed May 24 17:07:54 2006
From: h4w301 at gmail.com (Humphrey Widjaja)
Date: Wed, 24 May 2006 15:07:54 +0800
Subject: [netflow-tools] creating socket file (logsock)
Message-ID: <1052a31a0605240007v2de5c503wafdaaa2b59e8e3b8@mail.gmail.com>

Hi

I'm using logsock in Fedora 4.

But I see this error messages:

When the socket file is not created:
"connect to logsock: No such file or directory"

when creating the socket file with "mknod <socketfile> p":
"connect to logsock: Connection refused"

How to create socket file?

Regards,

Humphrey



From djm at mindrot.org  Wed May 24 19:35:56 2006
From: djm at mindrot.org (Damien Miller)
Date: Wed, 24 May 2006 19:35:56 +1000 (EST)
Subject: [netflow-tools] creating socket file (logsock)
In-Reply-To: <1052a31a0605240007v2de5c503wafdaaa2b59e8e3b8@mail.gmail.com>
References: <1052a31a0605240007v2de5c503wafdaaa2b59e8e3b8@mail.gmail.com>
Message-ID: <Pine.BSO.4.64.0605241934210.16192@fuyu.mindrot.org>

On Wed, 24 May 2006, Humphrey Widjaja wrote:

> Hi
> 
> I'm using logsock in Fedora 4.
> 
> But I see this error messages:
> 
> When the socket file is not created:
> "connect to logsock: No such file or directory"

I can't tell without some more context, but I would guess that you
have specified a logsock in a directory that does not exist.

Could you send you configuration and the full output of flowd.conf?

Also remember that logsock is still pretty experimental :)

> when creating the socket file with "mknod <socketfile> p":
> "connect to logsock: Connection refused"

No, don't do that - the log socket is created automatically.

-d



From h4w301 at gmail.com  Wed May 24 20:06:22 2006
From: h4w301 at gmail.com (Humphrey Widjaja)
Date: Wed, 24 May 2006 18:06:22 +0800
Subject: [netflow-tools] creating socket file (logsock)
In-Reply-To: <Pine.BSO.4.64.0605241934210.16192@fuyu.mindrot.org>
References: <1052a31a0605240007v2de5c503wafdaaa2b59e8e3b8@mail.gmail.com>
	<Pine.BSO.4.64.0605241934210.16192@fuyu.mindrot.org>
Message-ID: <1052a31a0605240306x6407ef6em7fb8abf5a99e89f0@mail.gmail.com>

On 5/24/06, Damien Miller <djm at mindrot.org> wrote:
>
> I can't tell without some more context, but I would guess that you
> have specified a logsock in a directory that does not exist.
>

The directory is exist as I could create the file with mknod.

As an alternate of socket file, I create /opt/_flowd/.fifo (with
"mknod <fifofile> p") and a PERL script to read from .fifo and write
it to another file with changing the filename every 15mins in this
format: flow.dat.yymmdd.HHMM

The reason of my script is to change the log filename every 15mins.

>
> Could you send you configuration and the full output of flowd.conf?
>

[root at localhost _flowd]# grep -v ^# flowd.conf

logsock "/opt/_flowd/.sock"
logfile "/opt/_flowd/.fifo"

pidfile "/var/run/flowd.pid"

listen on 0.0.0.0:1111
listen on 0.0.0.0:1112

flow source 10.0.0.0/8

store ALL

>
> Also remember that logsock is still pretty experimental :)
>

I know that and I want to be part of the experiment :)
Thanks for replying me