xref: /freebsd/share/man/man4/ng_netflow.4 (revision fa9896e082a1046ff4fbc75fcba4d18d1f2efc19)
1fad509c4SGleb Smirnoff.\" Copyright (c) 2004-2005 Gleb Smirnoff <glebius@FreeBSD.org>
29de7d9acSGleb Smirnoff.\" All rights reserved.
39de7d9acSGleb Smirnoff.\"
49de7d9acSGleb Smirnoff.\" Redistribution and use in source and binary forms, with or without
59de7d9acSGleb Smirnoff.\" modification, are permitted provided that the following conditions
69de7d9acSGleb Smirnoff.\" are met:
79de7d9acSGleb Smirnoff.\" 1. Redistributions of source code must retain the above copyright
89de7d9acSGleb Smirnoff.\"    notice, this list of conditions and the following disclaimer.
99de7d9acSGleb Smirnoff.\" 2. Redistributions in binary form must reproduce the above copyright
109de7d9acSGleb Smirnoff.\"    notice, this list of conditions and the following disclaimer in the
119de7d9acSGleb Smirnoff.\"    documentation and/or other materials provided with the distribution.
129de7d9acSGleb Smirnoff.\"
139de7d9acSGleb Smirnoff.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
149de7d9acSGleb Smirnoff.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
159de7d9acSGleb Smirnoff.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
169de7d9acSGleb Smirnoff.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
179de7d9acSGleb Smirnoff.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
189de7d9acSGleb Smirnoff.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
199de7d9acSGleb Smirnoff.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
209de7d9acSGleb Smirnoff.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
219de7d9acSGleb Smirnoff.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
229de7d9acSGleb Smirnoff.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
239de7d9acSGleb Smirnoff.\" SUCH DAMAGE.
249de7d9acSGleb Smirnoff.\"
25f44af086SGleb Smirnoff.Dd December 10, 2012
269de7d9acSGleb Smirnoff.Dt NG_NETFLOW 4
27aa12cea2SUlrich Spörlein.Os
289de7d9acSGleb Smirnoff.Sh NAME
299de7d9acSGleb Smirnoff.Nm ng_netflow
30c3e9f890SGleb Smirnoff.Nd Cisco's NetFlow implementation
31c8da77c0SRuslan Ermilov.Sh SYNOPSIS
32c8da77c0SRuslan Ermilov.In sys/types.h
33c8da77c0SRuslan Ermilov.In netinet/in.h
34c8da77c0SRuslan Ermilov.In netgraph/netflow/ng_netflow.h
359de7d9acSGleb Smirnoff.Sh DESCRIPTION
369de7d9acSGleb SmirnoffThe
379de7d9acSGleb Smirnoff.Nm
38c3e9f890SGleb Smirnoffnode implements Cisco's NetFlow export protocol on a router running
399de7d9acSGleb Smirnoff.Fx .
409de7d9acSGleb SmirnoffThe
419de7d9acSGleb Smirnoff.Nm
429de7d9acSGleb Smirnoffnode listens for incoming traffic and identifies unique flows in it.
439de7d9acSGleb SmirnoffFlows are distinguished by endpoint IP addresses, TCP/UDP port numbers,
449de7d9acSGleb SmirnoffToS and input interface.
458f8ab00fSGleb SmirnoffExpired flows are exported out of the node in NetFlow version 5/9 UDP datagrams.
469de7d9acSGleb SmirnoffExpiration reason can be one of the following:
479de7d9acSGleb Smirnoff.Bl -dash
489de7d9acSGleb Smirnoff.It
499de7d9acSGleb SmirnoffRST or FIN TCP segment.
509de7d9acSGleb Smirnoff.It
519de7d9acSGleb SmirnoffActive timeout.
529de7d9acSGleb SmirnoffFlows cannot live more than the specified period of time.
5387474270SRalf S. EngelschallThe default is 1800 seconds (30 minutes).
549de7d9acSGleb Smirnoff.It
559de7d9acSGleb SmirnoffInactive timeout.
569de7d9acSGleb SmirnoffA flow was inactive for the specified period of time.
5787474270SRalf S. EngelschallThe default is 15 seconds.
589de7d9acSGleb Smirnoff.El
599de7d9acSGleb Smirnoff.Pp
608f8ab00fSGleb SmirnoffNode supports IPv6 accounting (NetFlow v9 only) and is aware of multiple fibs.
618f8ab00fSGleb SmirnoffDifferent fibs are mapped to different domain_id in NetFlow V9 and different engine_id in NetFlow V5.
629de7d9acSGleb Smirnoff.Sh HOOKS
639de7d9acSGleb SmirnoffThis node type supports up to
649de7d9acSGleb Smirnoff.Dv NG_NETFLOW_MAXIFACES
658f8ab00fSGleb Smirnoff(default 65536) hooks named
669de7d9acSGleb Smirnoff.Va iface0 , iface1 ,
679de7d9acSGleb Smirnoffetc.,
68fad509c4SGleb Smirnoffand the same number of hooks named
69fad509c4SGleb Smirnoff.Va out0 , out1 ,
70fad509c4SGleb Smirnoffetc.,
718f8ab00fSGleb Smirnoffplus two export hooks:
728f8ab00fSGleb Smirnoff.Va export
738f8ab00fSGleb Smirnoff(for NetFlow version 5) and
748f8ab00fSGleb Smirnoff.Va export9
75*25972509SEdward Tomasz Napierala(for NetFlow version 9).
76*25972509SEdward Tomasz NapieralaExport can be done simultaneously for all supported export hooks.
77*25972509SEdward Tomasz NapieralaBy default (ingress NetFlow enabled) node does NetFlow accounting of data
78c31f137eSAlexander Motinreceived on
799de7d9acSGleb Smirnoff.Va iface*
80fad509c4SGleb Smirnoffhooks.
81fad509c4SGleb SmirnoffIf corresponding
82fad509c4SGleb Smirnoff.Va out
83fad509c4SGleb Smirnoffhook is connected, unmodified data is bypassed to it, otherwise data is freed.
84eaf02490SGleb SmirnoffIf data is received on
85eaf02490SGleb Smirnoff.Va out
86eaf02490SGleb Smirnoffhook, it is bypassed to corresponding
87eaf02490SGleb Smirnoff.Va iface
88c31f137eSAlexander Motinhook without any processing (egress NetFlow disabled by default).
898f8ab00fSGleb SmirnoffWhen full export datagram for an export protocol is built it is sent to the
909de7d9acSGleb Smirnoff.Va export
918f8ab00fSGleb Smirnoffor
928f8ab00fSGleb Smirnoff.Va export9
939de7d9acSGleb Smirnoffhook.
948f8ab00fSGleb SmirnoffIn normal operation, one (or more) export hook is connected to the
959de7d9acSGleb Smirnoff.Va inet/dgram/udp
969de7d9acSGleb Smirnoffhook of the
979de7d9acSGleb Smirnoff.Xr ng_ksocket 4
989de7d9acSGleb Smirnoffnode.
999de7d9acSGleb Smirnoff.Sh CONTROL MESSAGES
1009de7d9acSGleb SmirnoffThis node type supports the generic control messages, plus the following:
101c60bda17SJoel Dahl.Bl -tag -width foo
1020134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_INFO Pq Ic info
1039de7d9acSGleb SmirnoffReturns some node statistics and the current timeout values in a
1049de7d9acSGleb Smirnoff.Vt "struct ng_netflow_info" .
1050134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_IFINFO Pq Ic ifinfo
1069de7d9acSGleb SmirnoffReturns information about the
1079de7d9acSGleb Smirnoff.Va iface Ns Ar N
1089de7d9acSGleb Smirnoffhook.
1099de7d9acSGleb SmirnoffThe hook number is passed as an argument.
1100134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETDLT Pq Ic setdlt
1119de7d9acSGleb SmirnoffSets data link type on the
1129de7d9acSGleb Smirnoff.Va iface Ns Ar N
1139de7d9acSGleb Smirnoffhook.
11436374fcfSAlexander V. ChernikovCurrently, supported types are
11536374fcfSAlexander V. Chernikov.Cm DLT_RAW
11636374fcfSAlexander V. Chernikov(raw IP datagrams) and
11736374fcfSAlexander V. Chernikov.Cm DLT_EN10MB
11836374fcfSAlexander V. Chernikov(Ethernet).
11936374fcfSAlexander V. ChernikovDLT_ definitions can be found in
12036374fcfSAlexander V. Chernikov.In net/bpf.h
12136374fcfSAlexander V. Chernikovheader.
12236374fcfSAlexander V. ChernikovCurrently used values are 1 for
12336374fcfSAlexander V. Chernikov.Cm DLT_EN10MB
12436374fcfSAlexander V. Chernikovand 12 for
12536374fcfSAlexander V. Chernikov.Cm DLT_RAW .
1265ca2b383SRuslan ErmilovThis message type uses
1279de7d9acSGleb Smirnoff.Vt "struct ng_netflow_setdlt"
1289de7d9acSGleb Smirnoffas an argument:
1299de7d9acSGleb Smirnoff.Bd -literal -offset 4n
1309de7d9acSGleb Smirnoffstruct ng_netflow_setdlt {
1310134b5cbSGleb Smirnoff	uint16_t iface;		/* which iface dlt change */
1329de7d9acSGleb Smirnoff	uint8_t  dlt;		/* DLT_XXX from bpf.h */
1339de7d9acSGleb Smirnoff};
1349de7d9acSGleb Smirnoff.Ed
1359de7d9acSGleb Smirnoff.Pp
1369de7d9acSGleb SmirnoffThe requested
1379de7d9acSGleb Smirnoff.Va iface Ns Ar N
1389de7d9acSGleb Smirnoffhook must already be connected, otherwise message send operation will
1399de7d9acSGleb Smirnoffreturn an error.
1400134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETIFINDEX Pq Ic setifindex
1419de7d9acSGleb SmirnoffIn some cases,
1429de7d9acSGleb Smirnoff.Nm
1439de7d9acSGleb Smirnoffmay be unable to determine the input interface index of a packet.
1449de7d9acSGleb SmirnoffThis can happen if traffic enters the
1459de7d9acSGleb Smirnoff.Nm
1469de7d9acSGleb Smirnoffnode before it comes to the system interface's input queue.
1479de7d9acSGleb SmirnoffAn example of such a setup is capturing a traffic
1489de7d9acSGleb Smirnoff.Em between
1499de7d9acSGleb Smirnoffsynchronous data line and
1509de7d9acSGleb Smirnoff.Xr ng_iface 4 .
1519de7d9acSGleb SmirnoffIn this case, the input index should be associated with a given hook.
1529de7d9acSGleb SmirnoffThe interface's index can be determined via
1539de7d9acSGleb Smirnoff.Xr if_nametoindex 3
1549de7d9acSGleb Smirnofffrom userland.
1559de7d9acSGleb SmirnoffThis message requires
1569de7d9acSGleb Smirnoff.Vt "struct ng_netflow_setifindex"
1579de7d9acSGleb Smirnoffas an argument:
1589de7d9acSGleb Smirnoff.Bd -literal -offset 4n
1599de7d9acSGleb Smirnoffstruct ng_netflow_setifindex {
1600134b5cbSGleb Smirnoff	uint16_t iface;		/* which iface index change */
1616b99842aSEd Schouten	uint16_t index;		/* new index */
1629de7d9acSGleb Smirnoff};
1639de7d9acSGleb Smirnoff.Ed
1649de7d9acSGleb Smirnoff.Pp
1659de7d9acSGleb SmirnoffThe requested
1669de7d9acSGleb Smirnoff.Va iface Ns Ar N
1679de7d9acSGleb Smirnoffhook must already be connected, otherwise the message
1689de7d9acSGleb Smirnoffsend operation will return an error.
1690134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETTIMEOUTS Pq Ic settimeouts
170c3e9f890SGleb SmirnoffSets values in seconds for NetFlow active/inactive timeouts.
1719de7d9acSGleb SmirnoffThis message requires
1729de7d9acSGleb Smirnoff.Vt "struct ng_netflow_settimeouts"
1739de7d9acSGleb Smirnoffas an argument:
1749de7d9acSGleb Smirnoff.Bd -literal -offset 4n
1759de7d9acSGleb Smirnoffstruct ng_netflow_settimeouts {
1760134b5cbSGleb Smirnoff	uint32_t inactive_timeout;	/* flow inactive timeout */
1770134b5cbSGleb Smirnoff	uint32_t active_timeout;	/* flow active timeout */
1789de7d9acSGleb Smirnoff};
1799de7d9acSGleb Smirnoff.Ed
1800134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETCONFIG Pq Ic setconfig
181c31f137eSAlexander MotinSets configuration for the specified interface.
182c31f137eSAlexander MotinThis message requires
183c31f137eSAlexander Motin.Vt "struct ng_netflow_setconfig"
184c31f137eSAlexander Motinas an argument:
185c31f137eSAlexander Motin.Bd -literal -offset 4n
186c31f137eSAlexander Motinstruct ng_netflow_setconfig {
1870134b5cbSGleb Smirnoff	uint16_t iface;		/* which iface config change */
1880134b5cbSGleb Smirnoff	uint32_t conf;		/* new config */
189c31f137eSAlexander Motin#define NG_NETFLOW_CONF_INGRESS		1
190c31f137eSAlexander Motin#define NG_NETFLOW_CONF_EGRESS		2
191c31f137eSAlexander Motin#define NG_NETFLOW_CONF_ONCE		4
192c31f137eSAlexander Motin#define NG_NETFLOW_CONF_THISONCE	8
19336374fcfSAlexander V. Chernikov#define NG_NETFLOW_CONF_NOSRCLOOKUP	16
19436374fcfSAlexander V. Chernikov#define NG_NETFLOW_CONF_NODSTLOOKUP	32
195c31f137eSAlexander Motin};
196c31f137eSAlexander Motin.Ed
197c31f137eSAlexander Motin.Pp
198*25972509SEdward Tomasz NapieralaConfiguration is a bitmask of several options.
199*25972509SEdward Tomasz NapieralaOption NG_NETFLOW_CONF_INGRESS
200c31f137eSAlexander Motinenabled by default enables ingress NetFlow generation (for data coming from
20136374fcfSAlexander V. ChernikovifaceX hook).
20236374fcfSAlexander V. ChernikovOption
20336374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_EGRESS
20436374fcfSAlexander V. Chernikovenables egress NetFlow (for data coming from outX hook).
20536374fcfSAlexander V. ChernikovOption
20636374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_ONCE
20736374fcfSAlexander V. Chernikovdefines that packet should be accounted only once if it several times passes
20836374fcfSAlexander V. Chernikovvia netflow node.
20936374fcfSAlexander V. ChernikovOption
21036374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_THISONCE
21136374fcfSAlexander V. Chernikovdefines that packet should be accounted only once if it several times passes
21236374fcfSAlexander V. Chernikovvia exactly this netflow node.
21336374fcfSAlexander V. ChernikovThese two options are important to avoid duplicate accounting when both ingress
21436374fcfSAlexander V. Chernikovand egress NetFlow are enabled.
21536374fcfSAlexander V. ChernikovOption
21636374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_NOSRCLOOKUP
21736374fcfSAlexander V. Chernikovskips radix lookup on flow source address used to fill in network mask.
21836374fcfSAlexander V. ChernikovOption
21936374fcfSAlexander V. Chernikov.Va NG_NETFLOW_CONF_NODSTLOOKUP
22036374fcfSAlexander V. Chernikovskips radix lookup on destination (which fills egress interface id, destination
22136374fcfSAlexander V. Chernikovmask and gateway).
22236374fcfSAlexander V. ChernikovIf one doesn't need data provided by lookups, he/she can disable them, to reduce
22336374fcfSAlexander V. Chernikovload on routers.
2240134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETTEMPLATE Pq Ic settemplate
2258f8ab00fSGleb SmirnoffSets various timeouts to announce data flow templates
2268f8ab00fSGleb Smirnoff(NetFlow v9-specific). This message requires
2278f8ab00fSGleb Smirnoff.Vt "struct ng_netflow_settemplate"
2288f8ab00fSGleb Smirnoffas an argument:
2298f8ab00fSGleb Smirnoff.Bd -literal -offset 4n
2308f8ab00fSGleb Smirnoffstruct ng_netflow_settemplate {
2310134b5cbSGleb Smirnoff	uint16_t time;		/* max time between announce */
2320134b5cbSGleb Smirnoff	uint16_t packets;	/* max packets between announce */
2338f8ab00fSGleb Smirnoff};
2348f8ab00fSGleb Smirnoff.Ed
2358f8ab00fSGleb Smirnoff.Pp
2368f8ab00fSGleb SmirnoffValue of time field represents time in seconds to re-announce data templates.
2378f8ab00fSGleb SmirnoffValue of packets field represents maximum packets count between
2388f8ab00fSGleb Smirnoffre-announcing data templates.
2390134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_SETMTU Pq Ic setmtu
2408f8ab00fSGleb SmirnoffSets export interface MTU to build packets of specified size (NetFlow v9-specific).
2418f8ab00fSGleb SmirnoffThis message requires
2428f8ab00fSGleb Smirnoff.Vt "struct ng_netflow_setmtu"
2438f8ab00fSGleb Smirnoffas an argument:
2448f8ab00fSGleb Smirnoff.Bd -literal -offset 4n
2450134b5cbSGleb Smirnoffstruct ng_netflow_setemtu {
2460134b5cbSGleb Smirnoff	uint16_t mtu;		/* MTU for packet */
2478f8ab00fSGleb Smirnoff};
2488f8ab00fSGleb Smirnoff.Ed
2498f8ab00fSGleb Smirnoff.Pp
25050d922a0SGlen BarberDefault is 1500 bytes.
2519de7d9acSGleb Smirnoff.It Dv NGM_NETFLOW_SHOW
2529de7d9acSGleb SmirnoffThis control message asks a node to dump the entire contents of the flow cache.
2539de7d9acSGleb SmirnoffIt is called from
2549de7d9acSGleb Smirnoff.Xr flowctl 8 ,
2559de7d9acSGleb Smirnoffnot directly from
2569de7d9acSGleb Smirnoff.Xr ngctl 8 .
2570134b5cbSGleb Smirnoff.It Dv NGM_NETFLOW_V9INFO Pq Ic v9info
25883099d5cSAlexander V. ChernikovReturns some NetFlow v9 related values in a
2590134b5cbSGleb Smirnoff.Bd -literal -offset 4n
2600134b5cbSGleb Smirnoffstruct ng_netflow_v9info {
2610134b5cbSGleb Smirnoff    uint16_t        templ_packets;  /* v9 template packets */
2620134b5cbSGleb Smirnoff    uint16_t        templ_time;     /* v9 template time */
2630134b5cbSGleb Smirnoff    uint16_t        mtu;            /* v9 MTU */
2640134b5cbSGleb Smirnoff};
2650134b5cbSGleb Smirnoff.Ed
2669de7d9acSGleb Smirnoff.El
2679de7d9acSGleb Smirnoff.Sh SHUTDOWN
2689de7d9acSGleb SmirnoffThis node shuts down upon receipt of a
2699de7d9acSGleb Smirnoff.Dv NGM_SHUTDOWN
2709de7d9acSGleb Smirnoffcontrol message, or when all hooks have been disconnected.
2719de7d9acSGleb Smirnoff.Sh EXAMPLES
2729de7d9acSGleb SmirnoffThe simplest possible configuration is one Ethernet interface, where
2739de7d9acSGleb Smirnoffflow collecting is enabled.
2749de7d9acSGleb Smirnoff.Bd -literal -offset indent
2759de7d9acSGleb Smirnoff/usr/sbin/ngctl -f- <<-SEQ
276fad509c4SGleb Smirnoff	mkpeer fxp0: netflow lower iface0
277fad509c4SGleb Smirnoff	name fxp0:lower netflow
278fad509c4SGleb Smirnoff	connect fxp0: netflow: upper out0
2799de7d9acSGleb Smirnoff	mkpeer netflow: ksocket export inet/dgram/udp
2809de7d9acSGleb Smirnoff	msg netflow:export connect inet/10.0.0.1:4444
2819de7d9acSGleb SmirnoffSEQ
2829de7d9acSGleb Smirnoff.Ed
2839de7d9acSGleb Smirnoff.Pp
284c3e9f890SGleb SmirnoffThis is a more complicated example of a router with 2 NetFlow-enabled
2859de7d9acSGleb Smirnoffinterfaces
2869de7d9acSGleb Smirnoff.Li fxp0
2879de7d9acSGleb Smirnoffand
2889de7d9acSGleb Smirnoff.Li ng0 .
2899de7d9acSGleb SmirnoffNote that the
2909de7d9acSGleb Smirnoff.Va ng0:
2919de7d9acSGleb Smirnoffnode in this example is connected to
2929de7d9acSGleb Smirnoff.Xr ng_tee 4 .
293fad509c4SGleb SmirnoffThe latter sends us a copy of IP packets, which we analyze and free.
294fad509c4SGleb SmirnoffOn
295fad509c4SGleb Smirnoff.Va fxp0:
29650d922a0SGlen Barberwe do not use tee, but send packets back to either node.
2979de7d9acSGleb Smirnoff.Bd -literal -offset indent
2989de7d9acSGleb Smirnoff/usr/sbin/ngctl -f- <<-SEQ
2999de7d9acSGleb Smirnoff	# connect ng0's tee to iface0 hook
3009de7d9acSGleb Smirnoff	mkpeer ng0:inet netflow right2left iface0
3019de7d9acSGleb Smirnoff	name ng0:inet.right2left netflow
3029de7d9acSGleb Smirnoff	# set DLT to raw mode
3039de7d9acSGleb Smirnoff	msg netflow: setdlt { iface=0 dlt=12 }
3049de7d9acSGleb Smirnoff	# set interface index (5 in this example)
3059de7d9acSGleb Smirnoff	msg netflow: setifindex { iface=0 index=5 }
3069de7d9acSGleb Smirnoff
307fad509c4SGleb Smirnoff	# Connect fxp0: to iface1 and out1 hook
308fad509c4SGleb Smirnoff	connect fxp0: netflow: lower iface1
309fad509c4SGleb Smirnoff	connect fxp0: netflow: upper out1
3109de7d9acSGleb Smirnoff
3119de7d9acSGleb Smirnoff	# Create ksocket node on export hook, and configure it
3129de7d9acSGleb Smirnoff	# to send exports to proper destination
3139de7d9acSGleb Smirnoff	mkpeer netflow: ksocket export inet/dgram/udp
3149de7d9acSGleb Smirnoff	msg netflow:export connect inet/10.0.0.1:4444
3159de7d9acSGleb SmirnoffSEQ
3169de7d9acSGleb Smirnoff.Ed
3179de7d9acSGleb Smirnoff.Sh SEE ALSO
3188f8ab00fSGleb Smirnoff.Xr setfib 2 ,
3190b3504fdSChristian Brueffer.Xr netgraph 4 ,
320bf241837SGleb Smirnoff.Xr ng_ether 4 ,
321bf241837SGleb Smirnoff.Xr ng_iface 4 ,
3229de7d9acSGleb Smirnoff.Xr ng_ksocket 4 ,
3239de7d9acSGleb Smirnoff.Xr ng_tee 4 ,
3244f068961SRuslan Ermilov.Xr flowctl 8 ,
3259de7d9acSGleb Smirnoff.Xr ngctl 8
3268f8ab00fSGleb Smirnoff.Rs
3278f8ab00fSGleb Smirnoff.%A B. Claise, Ed
3288f8ab00fSGleb Smirnoff.%T "Cisco Systems NetFlow Services Export Version 9"
3298f8ab00fSGleb Smirnoff.%O RFC 3954
3308f8ab00fSGleb Smirnoff.Re
3319de7d9acSGleb Smirnoff.Pp
3328f8ab00fSGleb Smirnoff.Pa http://www.cisco.com/en/US/docs/ios/solutions_docs/netflow/nfwhite.html
3339de7d9acSGleb Smirnoff.Sh AUTHORS
3349de7d9acSGleb Smirnoff.An -nosplit
3359de7d9acSGleb SmirnoffThe
3369de7d9acSGleb Smirnoff.Nm
3379de7d9acSGleb Smirnoffnode type was written by
3386c899950SBaptiste Daroussin.An Gleb Smirnoff Aq Mt glebius@FreeBSD.org ,
3396c899950SBaptiste Daroussin.An Alexander Motin Aq Mt mav@FreeBSD.org ,
3406c899950SBaptiste Daroussin.An Alexander Chernikov Aq Mt melifaro@ipfw.ru .
3418f8ab00fSGleb SmirnoffThe initial code was based on
3429de7d9acSGleb Smirnoff.Nm ng_ipacct
3439de7d9acSGleb Smirnoffwritten by
3446c899950SBaptiste Daroussin.An Roman V. Palagin Aq Mt romanp@unshadow.net .
3459cbda590SRuslan Ermilov.Sh BUGS
3468b399842SGleb SmirnoffCache snapshot obtained via
3478b399842SGleb Smirnoff.Dv NGM_NETFLOW_SHOW
3488b399842SGleb Smirnoffcommand may lack some percentage of entries under severe load.
3498b399842SGleb Smirnoff.Pp
3509cbda590SRuslan ErmilovThe
3519cbda590SRuslan Ermilov.Nm
3529cbda590SRuslan Ermilovnode type does not fill in AS numbers.
3539cbda590SRuslan ErmilovThis is due to the lack of necessary information in the kernel routing table.
3549cbda590SRuslan ErmilovHowever, this information can be injected into the kernel from a routing daemon
3559cbda590SRuslan Ermilovsuch as GNU Zebra.
3569cbda590SRuslan ErmilovThis functionality may become available in future releases.
357