[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter
Subject:    Re: NetFlow / sFlow / IPFIX network probe proposal
From:       Roman Tsisyk <roman () tsisyk ! com>
Date:       2010-03-31 13:47:39
Message-ID: n2yfaefb3f11003310647uef53fd2k518c4c8f0367adc5 () mail ! gmail ! com
[Download RAW message or body]

On Wed, Mar 31, 2010 at 2:06 AM, Stig Thormodsrud <stig@vyatta.com> wrote:
> Hi Roman,
>
> You mentioned that netflow exporter is the most requested feature on
> Vyatta.  That was true until today when VC6 was release with our 1st
> netflow/sflow exporter.  I used pmacct (http://www.pmacct.net) and ULOG
> to get the packets to uacctd.  There's certainly a lot more that can be
> done to support higher bandwidth interfaces.  I'm considering PF_RING.

I've read Vyatta site before VC6 was released :)
This is a ULOG-based solution or not?

On Tue, Mar 30, 2010 at 11:39 PM, Patrick McHardy <kaber@trash.net> wrote:
> We already have conntrack and ctnetlink to gather per-connection
> statistics, which should decrease the overhead for doing this in
> userspace a lot. There also exists a netflow plugin for ulogd2,
> but I'm not sure it was already submitted and merged.
>

Thank you for pointing it out, I didn't know about conntrack support in ulogd.

As far as I understood, IPFIX output in ulogd is in a early stage and
don't work. So, I tested ulogd + ctnetlink with null output and it
worked very well.
CPU load was about 5-10%, and it's just nothing on this router.
However, I'm not sure that output is correct and all flows was
accounted. I also don't know what is about active and inactive
timeouts in this approach.
I'll look to ulogd_inpflow_NFCT more closely.

Patrick, decision is to optimize ctnetlink and not to make accounting
in the kernel space?

-- 
WBR, Tsisyk Roman
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]