1fad509c4SGleb Smirnoff.\" Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org> 29de7d9acSGleb Smirnoff.\" All rights reserved. 39de7d9acSGleb Smirnoff.\" 49de7d9acSGleb Smirnoff.\" Redistribution and use in source and binary forms, with or without 59de7d9acSGleb Smirnoff.\" modification, are permitted provided that the following conditions 69de7d9acSGleb Smirnoff.\" are met: 79de7d9acSGleb Smirnoff.\" 1. Redistributions of source code must retain the above copyright 89de7d9acSGleb Smirnoff.\" notice, this list of conditions and the following disclaimer. 99de7d9acSGleb Smirnoff.\" 2. Redistributions in binary form must reproduce the above copyright 109de7d9acSGleb Smirnoff.\" notice, this list of conditions and the following disclaimer in the 119de7d9acSGleb Smirnoff.\" documentation and/or other materials provided with the distribution. 129de7d9acSGleb Smirnoff.\" 139de7d9acSGleb Smirnoff.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 149de7d9acSGleb Smirnoff.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 159de7d9acSGleb Smirnoff.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 169de7d9acSGleb Smirnoff.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 179de7d9acSGleb Smirnoff.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 189de7d9acSGleb Smirnoff.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 199de7d9acSGleb Smirnoff.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 209de7d9acSGleb Smirnoff.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 219de7d9acSGleb Smirnoff.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 229de7d9acSGleb Smirnoff.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 239de7d9acSGleb Smirnoff.\" SUCH DAMAGE. 249de7d9acSGleb Smirnoff.\" 25f44af086SGleb Smirnoff.Dd December 10, 2012 269de7d9acSGleb Smirnoff.Dt NG_NETFLOW 4 27aa12cea2SUlrich Spörlein.Os 289de7d9acSGleb Smirnoff.Sh NAME 299de7d9acSGleb Smirnoff.Nm ng_netflow 30c3e9f890SGleb Smirnoff.Nd Cisco's NetFlow implementation 31c8da77c0SRuslan Ermilov.Sh SYNOPSIS 32c8da77c0SRuslan Ermilov.In sys/types.h 33c8da77c0SRuslan Ermilov.In netinet/in.h 34c8da77c0SRuslan Ermilov.In netgraph/netflow/ng_netflow.h 359de7d9acSGleb Smirnoff.Sh DESCRIPTION 369de7d9acSGleb SmirnoffThe 379de7d9acSGleb Smirnoff.Nm 38c3e9f890SGleb Smirnoffnode implements Cisco's NetFlow export protocol on a router running 399de7d9acSGleb Smirnoff.Fx . 409de7d9acSGleb SmirnoffThe 419de7d9acSGleb Smirnoff.Nm 429de7d9acSGleb Smirnoffnode listens for incoming traffic and identifies unique flows in it. 439de7d9acSGleb SmirnoffFlows are distinguished by endpoint IP addresses, TCP/UDP port numbers, 449de7d9acSGleb SmirnoffToS and input interface. 458f8ab00fSGleb SmirnoffExpired flows are exported out of the node in NetFlow version 5/9 UDP datagrams. 469de7d9acSGleb SmirnoffExpiration reason can be one of the following: 479de7d9acSGleb Smirnoff.Bl -dash 489de7d9acSGleb Smirnoff.It 499de7d9acSGleb SmirnoffRST or FIN TCP segment. 509de7d9acSGleb Smirnoff.It 519de7d9acSGleb SmirnoffActive timeout. 529de7d9acSGleb SmirnoffFlows cannot live more than the specified period of time. 5387474270SRalf S. EngelschallThe default is 1800 seconds (30 minutes). 549de7d9acSGleb Smirnoff.It 559de7d9acSGleb SmirnoffInactive timeout. 569de7d9acSGleb SmirnoffA flow was inactive for the specified period of time. 5787474270SRalf S. EngelschallThe default is 15 seconds. 589de7d9acSGleb Smirnoff.El 599de7d9acSGleb Smirnoff.Pp 608f8ab00fSGleb SmirnoffNode supports IPv6 accounting (NetFlow v9 only) and is aware of multiple fibs. 618f8ab00fSGleb SmirnoffDifferent fibs are mapped to different domain_id in NetFlow V9 and different engine_id in NetFlow V5. 629de7d9acSGleb Smirnoff.Sh HOOKS 639de7d9acSGleb SmirnoffThis node type supports up to 649de7d9acSGleb Smirnoff.Dv NG_NETFLOW_MAXIFACES 658f8ab00fSGleb Smirnoff(default 65536) hooks named 669de7d9acSGleb Smirnoff.Va iface0 , iface1 , 679de7d9acSGleb Smirnoffetc., 68fad509c4SGleb Smirnoffand the same number of hooks named 69fad509c4SGleb Smirnoff.Va out0 , out1 , 70fad509c4SGleb Smirnoffetc., 718f8ab00fSGleb Smirnoffplus two export hooks: 728f8ab00fSGleb Smirnoff.Va export 738f8ab00fSGleb Smirnoff(for NetFlow version 5) and 748f8ab00fSGleb Smirnoff.Va export9 75*25972509SEdward Tomasz Napierala(for NetFlow version 9). 76*25972509SEdward Tomasz NapieralaExport can be done simultaneously for all supported export hooks. 77*25972509SEdward Tomasz NapieralaBy default (ingress NetFlow enabled) node does NetFlow accounting of data 78c31f137eSAlexander Motinreceived on 799de7d9acSGleb Smirnoff.Va iface* 80fad509c4SGleb Smirnoffhooks. 81fad509c4SGleb SmirnoffIf corresponding 82fad509c4SGleb Smirnoff.Va out 83fad509c4SGleb Smirnoffhook is connected, unmodified data is bypassed to it, otherwise data is freed. 84eaf02490SGleb SmirnoffIf data is received on 85eaf02490SGleb Smirnoff.Va out 86eaf02490SGleb Smirnoffhook, it is bypassed to corresponding 87eaf02490SGleb Smirnoff.Va iface 88c31f137eSAlexander Motinhook without any processing (egress NetFlow disabled by default). 898f8ab00fSGleb SmirnoffWhen full export datagram for an export protocol is built it is sent to the 909de7d9acSGleb Smirnoff.Va export 918f8ab00fSGleb Smirnoffor 928f8ab00fSGleb Smirnoff.Va export9 939de7d9acSGleb Smirnoffhook. 948f8ab00fSGleb SmirnoffIn normal operation, one (or more) export hook is connected to the 959de7d9acSGleb Smirnoff.Va inet/dgram/udp 969de7d9acSGleb Smirnoffhook of the 979de7d9acSGleb Smirnoff.Xr ng_ksocket 4 989de7d9acSGleb Smirnoffnode. 999de7d9acSGleb Smirnoff.Sh CONTROL MESSAGES 1009de7d9acSGleb SmirnoffThis node type supports the generic control messages, plus the following: 101c60bda17SJoel Dahl.Bl -tag -width foo 1020134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_INFO Pq Ic info 1039de7d9acSGleb SmirnoffReturns some node statistics and the current timeout values in a 1049de7d9acSGleb Smirnoff.Vt "struct ng_netflow_info" . 1050134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_IFINFO Pq Ic ifinfo 1069de7d9acSGleb SmirnoffReturns information about the 1079de7d9acSGleb Smirnoff.Va iface Ns Ar N 1089de7d9acSGleb Smirnoffhook. 1099de7d9acSGleb SmirnoffThe hook number is passed as an argument. 1100134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETDLT Pq Ic setdlt 1119de7d9acSGleb SmirnoffSets data link type on the 1129de7d9acSGleb Smirnoff.Va iface Ns Ar N 1139de7d9acSGleb Smirnoffhook. 11436374fcfSAlexander V. ChernikovCurrently, supported types are 11536374fcfSAlexander V. Chernikov.Cm DLT_RAW 11636374fcfSAlexander V. Chernikov(raw IP datagrams) and 11736374fcfSAlexander V. Chernikov.Cm DLT_EN10MB 11836374fcfSAlexander V. Chernikov(Ethernet). 11936374fcfSAlexander V. ChernikovDLT_ definitions can be found in 12036374fcfSAlexander V. Chernikov.In net/bpf.h 12136374fcfSAlexander V. Chernikovheader. 12236374fcfSAlexander V. ChernikovCurrently used values are 1 for 12336374fcfSAlexander V. Chernikov.Cm DLT_EN10MB 12436374fcfSAlexander V. Chernikovand 12 for 12536374fcfSAlexander V. Chernikov.Cm DLT_RAW . 1265ca2b383SRuslan ErmilovThis message type uses 1279de7d9acSGleb Smirnoff.Vt "struct ng_netflow_setdlt" 1289de7d9acSGleb Smirnoffas an argument: 1299de7d9acSGleb Smirnoff.Bd -literal -offset 4n 1309de7d9acSGleb Smirnoffstruct ng_netflow_setdlt { 1310134b5cbSGleb Smirnoff uint16_t iface; /* which iface dlt change */ 1329de7d9acSGleb Smirnoff uint8_t dlt; /* DLT_XXX from bpf.h */ 1339de7d9acSGleb Smirnoff}; 1349de7d9acSGleb Smirnoff.Ed 1359de7d9acSGleb Smirnoff.Pp 1369de7d9acSGleb SmirnoffThe requested 1379de7d9acSGleb Smirnoff.Va iface Ns Ar N 1389de7d9acSGleb Smirnoffhook must already be connected, otherwise message send operation will 1399de7d9acSGleb Smirnoffreturn an error. 1400134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETIFINDEX Pq Ic setifindex 1419de7d9acSGleb SmirnoffIn some cases, 1429de7d9acSGleb Smirnoff.Nm 1439de7d9acSGleb Smirnoffmay be unable to determine the input interface index of a packet. 1449de7d9acSGleb SmirnoffThis can happen if traffic enters the 1459de7d9acSGleb Smirnoff.Nm 1469de7d9acSGleb Smirnoffnode before it comes to the system interface's input queue. 1479de7d9acSGleb SmirnoffAn example of such a setup is capturing a traffic 1489de7d9acSGleb Smirnoff.Em between 1499de7d9acSGleb Smirnoffsynchronous data line and 1509de7d9acSGleb Smirnoff.Xr ng_iface 4 . 1519de7d9acSGleb SmirnoffIn this case, the input index should be associated with a given hook. 1529de7d9acSGleb SmirnoffThe interface's index can be determined via 1539de7d9acSGleb Smirnoff.Xr if_nametoindex 3 1549de7d9acSGleb Smirnofffrom userland. 1559de7d9acSGleb SmirnoffThis message requires 1569de7d9acSGleb Smirnoff.Vt "struct ng_netflow_setifindex" 1579de7d9acSGleb Smirnoffas an argument: 1589de7d9acSGleb Smirnoff.Bd -literal -offset 4n 1599de7d9acSGleb Smirnoffstruct ng_netflow_setifindex { 1600134b5cbSGleb Smirnoff uint16_t iface; /* which iface index change */ 1616b99842aSEd Schouten uint16_t index; /* new index */ 1629de7d9acSGleb Smirnoff}; 1639de7d9acSGleb Smirnoff.Ed 1649de7d9acSGleb Smirnoff.Pp 1659de7d9acSGleb SmirnoffThe requested 1669de7d9acSGleb Smirnoff.Va iface Ns Ar N 1679de7d9acSGleb Smirnoffhook must already be connected, otherwise the message 1689de7d9acSGleb Smirnoffsend operation will return an error. 1690134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETTIMEOUTS Pq Ic settimeouts 170c3e9f890SGleb SmirnoffSets values in seconds for NetFlow active/inactive timeouts. 1719de7d9acSGleb SmirnoffThis message requires 1729de7d9acSGleb Smirnoff.Vt "struct ng_netflow_settimeouts" 1739de7d9acSGleb Smirnoffas an argument: 1749de7d9acSGleb Smirnoff.Bd -literal -offset 4n 1759de7d9acSGleb Smirnoffstruct ng_netflow_settimeouts { 1760134b5cbSGleb Smirnoff uint32_t inactive_timeout; /* flow inactive timeout */ 1770134b5cbSGleb Smirnoff uint32_t active_timeout; /* flow active timeout */ 1789de7d9acSGleb Smirnoff}; 1799de7d9acSGleb Smirnoff.Ed 1800134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETCONFIG Pq Ic setconfig 181c31f137eSAlexander MotinSets configuration for the specified interface. 182c31f137eSAlexander MotinThis message requires 183c31f137eSAlexander Motin.Vt "struct ng_netflow_setconfig" 184c31f137eSAlexander Motinas an argument: 185c31f137eSAlexander Motin.Bd -literal -offset 4n 186c31f137eSAlexander Motinstruct ng_netflow_setconfig { 1870134b5cbSGleb Smirnoff uint16_t iface; /* which iface config change */ 1880134b5cbSGleb Smirnoff uint32_t conf; /* new config */ 189c31f137eSAlexander Motin#define NG_NETFLOW_CONF_INGRESS 1 190c31f137eSAlexander Motin#define NG_NETFLOW_CONF_EGRESS 2 191c31f137eSAlexander Motin#define NG_NETFLOW_CONF_ONCE 4 192c31f137eSAlexander Motin#define NG_NETFLOW_CONF_THISONCE 8 19336374fcfSAlexander V. Chernikov#define NG_NETFLOW_CONF_NOSRCLOOKUP 16 19436374fcfSAlexander V. Chernikov#define NG_NETFLOW_CONF_NODSTLOOKUP 32 195c31f137eSAlexander Motin}; 196c31f137eSAlexander Motin.Ed 197c31f137eSAlexander Motin.Pp 198*25972509SEdward Tomasz NapieralaConfiguration is a bitmask of several options. 199*25972509SEdward Tomasz NapieralaOption NG_NETFLOW_CONF_INGRESS 200c31f137eSAlexander Motinenabled by default enables ingress NetFlow generation (for data coming from 20136374fcfSAlexander V. ChernikovifaceX hook). 20236374fcfSAlexander V. ChernikovOption 20336374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_EGRESS 20436374fcfSAlexander V. Chernikovenables egress NetFlow (for data coming from outX hook). 20536374fcfSAlexander V. ChernikovOption 20636374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_ONCE 20736374fcfSAlexander V. Chernikovdefines that packet should be accounted only once if it several times passes 20836374fcfSAlexander V. Chernikovvia netflow node. 20936374fcfSAlexander V. ChernikovOption 21036374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_THISONCE 21136374fcfSAlexander V. Chernikovdefines that packet should be accounted only once if it several times passes 21236374fcfSAlexander V. Chernikovvia exactly this netflow node. 21336374fcfSAlexander V. ChernikovThese two options are important to avoid duplicate accounting when both ingress 21436374fcfSAlexander V. Chernikovand egress NetFlow are enabled. 21536374fcfSAlexander V. ChernikovOption 21636374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_NOSRCLOOKUP 21736374fcfSAlexander V. Chernikovskips radix lookup on flow source address used to fill in network mask. 21836374fcfSAlexander V. ChernikovOption 21936374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_NODSTLOOKUP 22036374fcfSAlexander V. Chernikovskips radix lookup on destination (which fills egress interface id, destination 22136374fcfSAlexander V. Chernikovmask and gateway). 22236374fcfSAlexander V. ChernikovIf one doesn't need data provided by lookups, he/she can disable them, to reduce 22336374fcfSAlexander V. Chernikovload on routers. 2240134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETTEMPLATE Pq Ic settemplate 2258f8ab00fSGleb SmirnoffSets various timeouts to announce data flow templates 2268f8ab00fSGleb Smirnoff(NetFlow v9-specific). This message requires 2278f8ab00fSGleb Smirnoff.Vt "struct ng_netflow_settemplate" 2288f8ab00fSGleb Smirnoffas an argument: 2298f8ab00fSGleb Smirnoff.Bd -literal -offset 4n 2308f8ab00fSGleb Smirnoffstruct ng_netflow_settemplate { 2310134b5cbSGleb Smirnoff uint16_t time; /* max time between announce */ 2320134b5cbSGleb Smirnoff uint16_t packets; /* max packets between announce */ 2338f8ab00fSGleb Smirnoff}; 2348f8ab00fSGleb Smirnoff.Ed 2358f8ab00fSGleb Smirnoff.Pp 2368f8ab00fSGleb SmirnoffValue of time field represents time in seconds to re-announce data templates. 2378f8ab00fSGleb SmirnoffValue of packets field represents maximum packets count between 2388f8ab00fSGleb Smirnoffre-announcing data templates. 2390134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETMTU Pq Ic setmtu 2408f8ab00fSGleb SmirnoffSets export interface MTU to build packets of specified size (NetFlow v9-specific). 2418f8ab00fSGleb SmirnoffThis message requires 2428f8ab00fSGleb Smirnoff.Vt "struct ng_netflow_setmtu" 2438f8ab00fSGleb Smirnoffas an argument: 2448f8ab00fSGleb Smirnoff.Bd -literal -offset 4n 2450134b5cbSGleb Smirnoffstruct ng_netflow_setemtu { 2460134b5cbSGleb Smirnoff uint16_t mtu; /* MTU for packet */ 2478f8ab00fSGleb Smirnoff}; 2488f8ab00fSGleb Smirnoff.Ed 2498f8ab00fSGleb Smirnoff.Pp 25050d922a0SGlen BarberDefault is 1500 bytes. 2519de7d9acSGleb Smirnoff.It Dv NGM_NETFLOW_SHOW 2529de7d9acSGleb SmirnoffThis control message asks a node to dump the entire contents of the flow cache. 2539de7d9acSGleb SmirnoffIt is called from 2549de7d9acSGleb Smirnoff.Xr flowctl 8 , 2559de7d9acSGleb Smirnoffnot directly from 2569de7d9acSGleb Smirnoff.Xr ngctl 8 . 2570134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_V9INFO Pq Ic v9info 25883099d5cSAlexander V. ChernikovReturns some NetFlow v9 related values in a 2590134b5cbSGleb Smirnoff.Bd -literal -offset 4n 2600134b5cbSGleb Smirnoffstruct ng_netflow_v9info { 2610134b5cbSGleb Smirnoff uint16_t templ_packets; /* v9 template packets */ 2620134b5cbSGleb Smirnoff uint16_t templ_time; /* v9 template time */ 2630134b5cbSGleb Smirnoff uint16_t mtu; /* v9 MTU */ 2640134b5cbSGleb Smirnoff}; 2650134b5cbSGleb Smirnoff.Ed 2669de7d9acSGleb Smirnoff.El 2679de7d9acSGleb Smirnoff.Sh SHUTDOWN 2689de7d9acSGleb SmirnoffThis node shuts down upon receipt of a 2699de7d9acSGleb Smirnoff.Dv NGM_SHUTDOWN 2709de7d9acSGleb Smirnoffcontrol message, or when all hooks have been disconnected. 2719de7d9acSGleb Smirnoff.Sh EXAMPLES 2729de7d9acSGleb SmirnoffThe simplest possible configuration is one Ethernet interface, where 2739de7d9acSGleb Smirnoffflow collecting is enabled. 2749de7d9acSGleb Smirnoff.Bd -literal -offset indent 2759de7d9acSGleb Smirnoff/usr/sbin/ngctl -f- <<-SEQ 276fad509c4SGleb Smirnoff mkpeer fxp0: netflow lower iface0 277fad509c4SGleb Smirnoff name fxp0:lower netflow 278fad509c4SGleb Smirnoff connect fxp0: netflow: upper out0 2799de7d9acSGleb Smirnoff mkpeer netflow: ksocket export inet/dgram/udp 2809de7d9acSGleb Smirnoff msg netflow:export connect inet/10.0.0.1:4444 2819de7d9acSGleb SmirnoffSEQ 2829de7d9acSGleb Smirnoff.Ed 2839de7d9acSGleb Smirnoff.Pp 284c3e9f890SGleb SmirnoffThis is a more complicated example of a router with 2 NetFlow-enabled 2859de7d9acSGleb Smirnoffinterfaces 2869de7d9acSGleb Smirnoff.Li fxp0 2879de7d9acSGleb Smirnoffand 2889de7d9acSGleb Smirnoff.Li ng0 . 2899de7d9acSGleb SmirnoffNote that the 2909de7d9acSGleb Smirnoff.Va ng0: 2919de7d9acSGleb Smirnoffnode in this example is connected to 2929de7d9acSGleb Smirnoff.Xr ng_tee 4 . 293fad509c4SGleb SmirnoffThe latter sends us a copy of IP packets, which we analyze and free. 294fad509c4SGleb SmirnoffOn 295fad509c4SGleb Smirnoff.Va fxp0: 29650d922a0SGlen Barberwe do not use tee, but send packets back to either node. 2979de7d9acSGleb Smirnoff.Bd -literal -offset indent 2989de7d9acSGleb Smirnoff/usr/sbin/ngctl -f- <<-SEQ 2999de7d9acSGleb Smirnoff # connect ng0's tee to iface0 hook 3009de7d9acSGleb Smirnoff mkpeer ng0:inet netflow right2left iface0 3019de7d9acSGleb Smirnoff name ng0:inet.right2left netflow 3029de7d9acSGleb Smirnoff # set DLT to raw mode 3039de7d9acSGleb Smirnoff msg netflow: setdlt { iface=0 dlt=12 } 3049de7d9acSGleb Smirnoff # set interface index (5 in this example) 3059de7d9acSGleb Smirnoff msg netflow: setifindex { iface=0 index=5 } 3069de7d9acSGleb Smirnoff 307fad509c4SGleb Smirnoff # Connect fxp0: to iface1 and out1 hook 308fad509c4SGleb Smirnoff connect fxp0: netflow: lower iface1 309fad509c4SGleb Smirnoff connect fxp0: netflow: upper out1 3109de7d9acSGleb Smirnoff 3119de7d9acSGleb Smirnoff # Create ksocket node on export hook, and configure it 3129de7d9acSGleb Smirnoff # to send exports to proper destination 3139de7d9acSGleb Smirnoff mkpeer netflow: ksocket export inet/dgram/udp 3149de7d9acSGleb Smirnoff msg netflow:export connect inet/10.0.0.1:4444 3159de7d9acSGleb SmirnoffSEQ 3169de7d9acSGleb Smirnoff.Ed 3179de7d9acSGleb Smirnoff.Sh SEE ALSO 3188f8ab00fSGleb Smirnoff.Xr setfib 2 , 3190b3504fdSChristian Brueffer.Xr netgraph 4 , 320bf241837SGleb Smirnoff.Xr ng_ether 4 , 321bf241837SGleb Smirnoff.Xr ng_iface 4 , 3229de7d9acSGleb Smirnoff.Xr ng_ksocket 4 , 3239de7d9acSGleb Smirnoff.Xr ng_tee 4 , 3244f068961SRuslan Ermilov.Xr flowctl 8 , 3259de7d9acSGleb Smirnoff.Xr ngctl 8 3268f8ab00fSGleb Smirnoff.Rs 3278f8ab00fSGleb Smirnoff.%A B. Claise, Ed 3288f8ab00fSGleb Smirnoff.%T "Cisco Systems NetFlow Services Export Version 9" 3298f8ab00fSGleb Smirnoff.%O RFC 3954 3308f8ab00fSGleb Smirnoff.Re 3319de7d9acSGleb Smirnoff.Pp 3328f8ab00fSGleb Smirnoff.Pa http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html 3339de7d9acSGleb Smirnoff.Sh AUTHORS 3349de7d9acSGleb Smirnoff.An -nosplit 3359de7d9acSGleb SmirnoffThe 3369de7d9acSGleb Smirnoff.Nm 3379de7d9acSGleb Smirnoffnode type was written by 3386c899950SBaptiste Daroussin.An Gleb Smirnoff Aq Mt glebius@FreeBSD.org , 3396c899950SBaptiste Daroussin.An Alexander Motin Aq Mt mav@FreeBSD.org , 3406c899950SBaptiste Daroussin.An Alexander Chernikov Aq Mt melifaro@ipfw.ru . 3418f8ab00fSGleb SmirnoffThe initial code was based on 3429de7d9acSGleb Smirnoff.Nm ng_ipacct 3439de7d9acSGleb Smirnoffwritten by 3446c899950SBaptiste Daroussin.An Roman V. Palagin Aq Mt romanp@unshadow.net . 3459cbda590SRuslan Ermilov.Sh BUGS 3468b399842SGleb SmirnoffCache snapshot obtained via 3478b399842SGleb Smirnoff.Dv NGM_NETFLOW_SHOW 3488b399842SGleb Smirnoffcommand may lack some percentage of entries under severe load. 3498b399842SGleb Smirnoff.Pp 3509cbda590SRuslan ErmilovThe 3519cbda590SRuslan Ermilov.Nm 3529cbda590SRuslan Ermilovnode type does not fill in AS numbers. 3539cbda590SRuslan ErmilovThis is due to the lack of necessary information in the kernel routing table. 3549cbda590SRuslan ErmilovHowever, this information can be injected into the kernel from a routing daemon 3559cbda590SRuslan Ermilovsuch as GNU Zebra. 3569cbda590SRuslan ErmilovThis functionality may become available in future releases. 357