From netramet-owner Fri Dec 10 23:28:25 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id XAA24488
for netramet-outgoing; Fri, 10 Dec 1999 23:23:24 +1300 (NZDT)
Received: from merkur.ecos.de (merkur.ecos.de [194.162.213.1])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id XAA24481
for <
[email protected]>; Fri, 10 Dec 1999 23:23:19 +1300 (NZDT)
Received: from mond (mond.gr.ecos.de [195.185.37.201])
by merkur.ecos.de (8.9.1/8.9.1) with SMTP id LAA09401
for <
[email protected]>; Fri, 10 Dec 1999 11:23:15 +0100
From: "Gerald Richter" <
[email protected]>
To: <
[email protected]>
Subject: NeTraMet and capturing ppp interfaces on Linux
Date: Fri, 10 Dec 1999 11:22:53 +0100
Message-ID: <
[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_001D_01BF4300.E6715030"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Importance: Normal
Sender:
[email protected]
Precedence: bulk
This is a multi-part message in MIME format.
------=_NextPart_000_001D_01BF4300.E6715030
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Hi,
I just worked a few days with NeTraMet and had the need to capture the ppp0
device on my Linux box. Since NeTraMe 4.3 doesn't support this link type, I
have added a few lines of code to meter_ux.c to support this. I append the
patch, maybe it helps somebody.
Gerald
-------------------------------------------------------------
Gerald Richter ecos electronic communication services gmbh
Internetconnect * Webserver/-design/-datenbanken * Consulting
Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz
E-Mail:
[email protected] Voice: +49 6133 925151
WWW:
http://www.ecos.de Fax: +49 6133 925152
-------------------------------------------------------------
------=_NextPart_000_001D_01BF4300.E6715030
Content-Type: application/octet-stream;
name="meter_ux.c.diff"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="meter_ux.c.diff"
--- meter_ux.c.org Fri Dec 10 10:33:01 1999=0A=
+++ meter_ux.c Fri Dec 10 11:16:09 1999=0A=
@@ -551,7 +551,8 @@=0A=
unsigned int line_nbr=3D0;=0A=
#endif=0A=
=0A=
-void ether_callback(struct interface_info *user, struct pcap_pkthdr *h, =
u_char *p)=0A=
+=0A=
+void ether_callback2(struct interface_info *user, struct pcap_pkthdr =
*h, u_char *p, int offset)=0A=
{=0A=
struct ether_hdr *ethp;=0A=
struct llc *llcp;=0A=
@@ -563,8 +564,8 @@=0A=
user->sample_count =3D user->SampleRate;=0A=
=0A=
ethp =3D (struct ether_hdr *)p;=0A=
- ether_type =3D get_short(ethp->type);=0A=
- p +=3D sizeof(struct ether_hdr);=0A=
+ ether_type =3D offset?get_short(ethp->type):0x800;=0A=
+ p +=3D offset ;=0A=
if (ether_type <=3D 1500) { /* 802.3 packet */=0A=
llcp =3D (struct llc *)p;=0A=
lsap =3D llcp->dsap << 8 | llcp->ssap;=0A=
@@ -609,6 +610,19 @@=0A=
}=0A=
}=0A=
=0A=
+=0A=
+void ether_callback(struct interface_info *user, struct pcap_pkthdr *h, =
u_char *p)=0A=
+{=0A=
+ ether_callback2(user, h, p, sizeof(struct ether_hdr)) ;=0A=
+ }=0A=
+=0A=
+void ppp_callback(struct interface_info *user, struct pcap_pkthdr *h, =
u_char *p)=0A=
+{=0A=
+ ether_callback2(user, h, p, 0) ;=0A=
+ }=0A=
+=0A=
+=0A=
+=0A=
void interface_read(struct interface_info *pi)=0A=
{=0A=
pcap_read(pi->pd, -1, pi->callback, (u_char *)pi);=0A=
@@ -636,6 +650,8 @@=0A=
type =3D pcap_datalink(pd);=0A=
if (type =3D=3D DLT_EN10MB || type =3D=3D DLT_IEEE802)=0A=
pi->callback =3D (pcap_handler)ether_callback;=0A=
+ else if (type =3D=3D DLT_RAW )=0A=
+ pi->callback =3D (pcap_handler)ppp_callback;=0A=
else if (type =3D=3D DLT_FDDI )=0A=
pi->callback =3D (pcap_handler)fddi_callback;=0A=
else { =0A=
------=_NextPart_000_001D_01BF4300.E6715030--
From netramet-owner Sat Dec 18 00:08:56 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id AAA21515
for netramet-outgoing; Sat, 18 Dec 1999 00:05:14 +1300 (NZDT)
Received: from netserv1.urc.ac.ru (netserv1.urc.ac.ru [193.233.85.33])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id AAA21392
for <
[email protected]>; Sat, 18 Dec 1999 00:01:19 +1300 (NZDT)
Received: from mbyte.comp.tu-chel.ac.ru (mbyte.comp.tu-chel.ac.ru [193.233.80.19])
by netserv1.urc.ac.ru (8.9.3/8.9.3) with ESMTP id PAA32386
for <
[email protected]>; Fri, 17 Dec 1999 15:59:24 +0500 (ES)
(envelope-from
[email protected])
Message-Id: <
[email protected]>
Received: from MBYTE/SpoolDir by mbyte.comp.tu-chel.ac.ru (Mercury 1.44);
17 Dec 99 15:57:50 +0500
Received: from SpoolDir by MBYTE (Mercury 1.44); 17 Dec 99 15:57:32 +0500
From: "Alex E. Zelenin" <
[email protected]>
Organization: ChGTU Computer Department
To:
[email protected]
Date: Fri, 17 Dec 1999 15:57:29 +500
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: multiple interfaces
Priority: normal
X-mailer: Pegasus Mail for Win32 (v3.12)
Sender:
[email protected]
Precedence: bulk
Hi !
Beg your pardon for my English and for may be stupid question.
What is an exact syntax of -i command line option of NeTraMet ? I've
just installed NeTraMet v4.3 on FreeBSD 3.3 stable and I want to
monitor 4 interfaces - lnc1, lnc2, lnc3, ed1. When I write
#NeTraMet -i lnc1 lnc2
I got :
Running on ur01.tu-chel.ac.ru, interface lnc1
When I try
#NeTraMet -i lnc1,lnc2
I got
Running on ur01.tu-chel.ac.ru1107:54 pcap_open_live(lnc1,lnc2):
lnc1,lnc2: Device not configured
So, would you please answer - what exactly I have to write to meter
my 4 interfaces ?
BTW, examples of command line will be nice in user manual.
Southern Ural State University
Division of WAN Technologies
Alexey E. Zelenin, Network Engineer
Phone:+7(3512)654992
E-mail:
[email protected]
From netramet-owner Sat Dec 18 03:19:49 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id DAA27928
for netramet-outgoing; Sat, 18 Dec 1999 03:19:16 +1300 (NZDT)
Received: from merkur.ecos.de (merkur.ecos.de [194.162.213.1])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id DAA27923
for <
[email protected]>; Sat, 18 Dec 1999 03:19:12 +1300 (NZDT)
Received: from mond (mond.gr.ecos.de [195.185.37.201])
by merkur.ecos.de (8.9.1/8.9.1) with SMTP id PAA22030;
Fri, 17 Dec 1999 15:14:53 +0100
From: "Gerald Richter" <
[email protected]>
To: "Alex E. Zelenin" <
[email protected]>, <
[email protected]>
Subject: RE: multiple interfaces
Date: Fri, 17 Dec 1999 15:14:26 +0100
Message-ID: <
[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
In-Reply-To: <
[email protected]>
Sender:
[email protected]
Precedence: bulk
> monitor 4 interfaces - lnc1, lnc2, lnc3, ed1. When I write
try
#NeTraMet -i lnc1 -i lnc2 -i lnc3 -i lnc4
-------------------------------------------------------------
Gerald Richter ecos electronic communication services gmbh
Internetconnect * Webserver/-design/-datenbanken * Consulting
Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz
E-Mail:
[email protected] Voice: +49 6133 925151
WWW:
http://www.ecos.de Fax: +49 6133 925152
-------------------------------------------------------------
From netramet-owner Tue Dec 21 00:34:51 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id AAA16884
for netramet-outgoing; Tue, 21 Dec 1999 00:27:49 +1300 (NZDT)
Received: from netserv1.urc.ac.ru (netserv1.urc.ac.ru [193.233.85.33])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id AAA16865
for <
[email protected]>; Tue, 21 Dec 1999 00:27:23 +1300 (NZDT)
Received: from mbyte.comp.tu-chel.ac.ru (mbyte.comp.tu-chel.ac.ru [193.233.80.19])
by netserv1.urc.ac.ru (8.9.3/8.9.3) with ESMTP id QAA31749
for <
[email protected]>; Mon, 20 Dec 1999 16:26:59 +0500 (ES)
(envelope-from
[email protected])
Message-Id: <
[email protected]>
Received: from MBYTE/SpoolDir by mbyte.comp.tu-chel.ac.ru (Mercury 1.44);
20 Dec 99 16:24:56 +0500
Received: from SpoolDir by MBYTE (Mercury 1.44); 20 Dec 99 16:24:39 +0500
From: "Alex E. Zelenin" <
[email protected]>
Organization: ChGTU Computer Department
To:
[email protected]
Date: Mon, 20 Dec 1999 16:24:33 +500
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: RE: multiple interfaces
Priority: normal
In-reply-to: <
[email protected]>
References: <
[email protected]>
X-mailer: Pegasus Mail for Win32 (v3.12)
Sender:
[email protected]
Precedence: bulk
> > monitor 4 interfaces - lnc1, lnc2, lnc3, ed1. When I write
>
> try
>
> #NeTraMet -i lnc1 -i lnc2 -i lnc3 -i lnc4
>
:(
#NeTraMet -i lnc1 -i lnc2
gives :
NeTraMet: Network Meter v4.3
Running on host.somewhere.net, interface lnc11136:33
pcap_open_live(lnc2): /dev/bpf1: No such file or directory
Any other ideas ?
Southern Ural State University
Division of WAN Technologies
Alexey E. Zelenin, Network Engineer
Phone:+7(3512)654992
E-mail:
[email protected]
From netramet-owner Tue Dec 21 02:40:16 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id CAA20745
for netramet-outgoing; Tue, 21 Dec 1999 02:39:42 +1300 (NZDT)
Received: from merkur.ecos.de (merkur.ecos.de [194.162.213.1])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id CAA20740
for <
[email protected]>; Tue, 21 Dec 1999 02:39:37 +1300 (NZDT)
Received: from mond (mond.gr.ecos.de [195.185.37.201])
by merkur.ecos.de (8.9.1/8.9.1) with SMTP id OAA27920;
Mon, 20 Dec 1999 14:34:34 +0100
From: "Gerald Richter" <
[email protected]>
To: "Alex E. Zelenin" <
[email protected]>, <
[email protected]>
Subject: RE: multiple interfaces
Date: Mon, 20 Dec 1999 14:34:03 +0100
Message-ID: <
[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0
In-Reply-To: <
[email protected]>
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Importance: Normal
Sender:
[email protected]
Precedence: bulk
> > > monitor 4 interfaces - lnc1, lnc2, lnc3, ed1. When I write
> >
> > try
> >
> > #NeTraMet -i lnc1 -i lnc2 -i lnc3 -i lnc4
> >
>
> :(
> #NeTraMet -i lnc1 -i lnc2
> gives :
> NeTraMet: Network Meter v4.3
> Running on host.somewhere.net, interface lnc11136:33
> pcap_open_live(lnc2): /dev/bpf1: No such file or directory
>
does
#NeTraMet -i lnc2
work?
Gerald
From netramet-owner Tue Dec 21 10:53:28 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id KAA29637
for netramet-outgoing; Tue, 21 Dec 1999 10:52:29 +1300 (NZDT)
Received: from orion.planetcable.net ([24.137.12.3])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id KAA29623
for <
[email protected]>; Tue, 21 Dec 1999 10:52:23 +1300 (NZDT)
Received: from delleh5r5 (24.137.9.4) by orion.planetcable.net (Worldmail 1.3.167) for
[email protected]; 20 Dec 1999 16:49:28 -0500
From: "Kevin A. Noll" <
[email protected]>
To: <
[email protected]>
Subject: Ruleset woes...
Date: Mon, 20 Dec 1999 16:52:23 -0500
Message-ID: <
[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
Importance: Normal
Sender:
[email protected]
Precedence: bulk
I have been working to get NeTraMet running for about a month now. I have
everything working okay, and collecting flow data. However, the flow data
files that I get from NeMaC don't make a lot of sense.
On most flow records in NeMaC's output, either the InOctets/InPDUs counters
are zero or the OutOctets/OutPDUs counters are zero.
Sometimes there will be two records for the same address pair, one with
the InOctets/InPDUs and one with the OutOctets/OutPDUs.
Does anyone have any thought as to why this occurs?
I would like to simply get a flow record that lists the InOctets and
OutOctets for a flow between a given Source/Destination address pair
over the collection period. It seems that this should be very simple
to do, but I just cannot seem to make it happen.
Below is my SRL rulefile:
-----------------------------Start SRL ----------------------------------
define LocalNets =
172.16.1/24,
172.17.1/24;
define Internal_Net =
10.0/8;
define All =
LocalNets, Internal_Net ;
if SourcePeerType == IP save;
else ignore;
if (SourcePeerAddress == (LocalNets) || DestPeerAddress == (LocalNets))
save;
else {
ignore;
# store FlowKind := 'U';
# save SourcePeerAddress /32;
# save DestPeerAddress /32;
# count;
}
if DestPeerAddress == (LocalNets) nomatch;
# We want the Local IP's as source
if SourcePeerAddress == (LocalNets)
save, {save SourcePeerAddress /32;
save SourceAdjacentAddress;
save DestAdjacentAddress;
store FlowKind := 'P';}
else if SourcePeerAddress == (Internal_Net)
save, {save SourcePeerAddress /32;
save DestAdjacentAddress;
save DestAdjacentAddress;
store FlowKind := 'N';}
else {
save SourcePeerAddress /32;
save DestAdjacentAddress;
save DestAdjacentAddress;
store FlowKind := '?';
}
save DestPeerAddress /32;
count;
set 4;
format
FlowKind " "
SourcePeerType SourcePeerAddress DestPeerAddress " "
ToPDUs ToOctets FromPDUs FromOctets;
-----------------------------End SRL ----------------------------------
Thanks.
--kan--
--
Kevin A. Noll, KD4WOZ
[email protected]
Lead Systems Engineer 717.249.8800
BFG Consulting, LLC
From netramet-owner Tue Dec 21 11:14:25 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id LAA03194
for netramet-outgoing; Tue, 21 Dec 1999 11:14:10 +1300 (NZDT)
Received: from n.browlee5.itss.auckland.ac.nz (n.brownlee5.itss.auckland.ac.nz [130.216.4.79])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with SMTP id LAA03178
for <netramet@auckland>; Tue, 21 Dec 1999 11:14:05 +1300 (NZDT)
From: Nevil Brownlee <
[email protected]>
To:
[email protected]
Subject:
[email protected]
Message-ID: <
[email protected]>
Date: Tue, 21 Dec 1999 11:13:16 +1300 (New Zealand Daylight Time)
Priority: NORMAL
X-Mailer: Simeon for Win32 Version 4.1.4 Build (40)
X-Authentication: none
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender:
[email protected]
Precedence: bulk
--- Begin Forwarded Message ---
Received: from harlan@localhost [127.0.0.1] (HELO pcnbs.pfcs.com)
by pcnbs.pfcs.com (8.9.3/8.8.8) via ESMTP
id <
[email protected]>;
Mon, 20 Dec 1999 13:01:15 -0500 (EST)
To: "Alex E. Zelenin" <
[email protected]>
cc:
[email protected]
Subject: Re: multiple interfaces
In-Reply-To: "Alex E. Zelenin"'s (
[email protected]) message
dated Mon, 20 Dec 1999 16:24:33. <
[email protected]>
Content-Type: text/plain; charset=US-ASCII
Date: Mon, 20 Dec 1999 13:01:15 -0500
Message-ID: <
[email protected]>
From: Harlan Stenn <
[email protected]>
Increase the number of BPF devices in your kernel, and DTRT to add more bpf
devices to /dev/ .
H
--- End Forwarded Message ---
From netramet-owner Tue Dec 21 14:03:01 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id OAA27257
for netramet-outgoing; Tue, 21 Dec 1999 14:02:34 +1300 (NZDT)
Received: from n.browlee5.itss.auckland.ac.nz (n.brownlee5.itss.auckland.ac.nz [130.216.4.79])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with SMTP id OAA27207;
Tue, 21 Dec 1999 14:02:16 +1300 (NZDT)
From: Nevil Brownlee <
[email protected]>
To: "Kevin A. Noll" <
[email protected]>
Cc:
[email protected]
Subject: Re: Ruleset woes...
In-Reply-To: <
[email protected]>
Message-ID: <
[email protected]>
Date: Tue, 21 Dec 1999 14:01:27 +1300 (New Zealand Daylight Time)
Priority: NORMAL
X-Mailer: Simeon for Win32 Version 4.1.4 Build (40)
X-Authentication: none
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender:
[email protected]
Precedence: bulk
Hello Kevin:
> On most flow records in NeMaC's output, either the
> InOctets/InPDUs counters are zero or the OutOctets/OutPDUs counters are
> zero.
>
> Sometimes there will be two records for the same address pair, one with
> the InOctets/InPDUs and one with the OutOctets/OutPDUs.
I think (mind, I say I think) your problems come from trying to
handle the 'source vs destination' processing yourself in the SRL
program. I've appended a test program below which just tests whether
one of the nets you're interested in is the Source, and leaves the meter
to sort things out from there. Please try this and let me know how
you get on.
Cheers, Nevil
+---------------------------------------------------------------------+
| Nevil Brownlee Director, Technology Development |
| Phone: +64 9 373 7599 x8941 ITSS, The University of Auckland |
| FAX: +64 9 373 7021 Private Bag 92019, Auckland, New Zealand |
+---------------------------------------------------------------------P
define LocalNets =
172.16.1/24,
172.17.1/24;
define Internal_Net =
10.0/8;
define All =
LocalNets, Internal_Net ;
if SourcePeerType == IP save;
else ignore;
if SourcePeerAddress == (All) {
if SourcePeerAddress == (LocalNets)
store FlowKind := 'P';
else if SourcePeerAddress == (Internal_Net)
store FlowKind := 'N';
else store FlowKind := '?';
save SourcePeerAddress/32;
save DestPeerAddress/32;
count;
}
set 4;
format
FlowKind " "
SourcePeerType SourcePeerAddress DestPeerAddress " "
ToPDUs ToOctets FromPDUs FromOctets;
From netramet-owner Wed Dec 22 23:13:59 1999
Received: (from majordom@localhost)
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) id XAA05538
for netramet-outgoing; Wed, 22 Dec 1999 23:08:40 +1300 (NZDT)
Received: from netserv1.urc.ac.ru (netserv1.urc.ac.ru [193.233.85.33])
by mailhost.auckland.ac.nz (8.9.2/8.9.2/8.9.2-ua) with ESMTP id XAA05522
for <
[email protected]>; Wed, 22 Dec 1999 23:08:27 +1300 (NZDT)
Received: from mbyte.comp.tu-chel.ac.ru (mbyte.comp.tu-chel.ac.ru [193.233.80.19])
by netserv1.urc.ac.ru (8.9.3/8.9.3) with ESMTP id PAA66863
for <
[email protected]>; Wed, 22 Dec 1999 15:08:10 +0500 (ES)
(envelope-from
[email protected])
Message-Id: <
[email protected]>
Received: from MBYTE/SpoolDir by mbyte.comp.tu-chel.ac.ru (Mercury 1.44);
22 Dec 99 15:07:14 +0500
Received: from SpoolDir by MBYTE (Mercury 1.44); 22 Dec 99 15:06:49 +0500
From: "Alex E. Zelenin" <
[email protected]>
Organization: ChGTU Computer Department
To:
[email protected]
Date: Wed, 22 Dec 1999 15:06:36 +500
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Multiple interfaces - thanx a lot, problem solved. (empty)
Priority: normal
X-mailer: Pegasus Mail for Win32 (v3.12)
Sender:
[email protected]
Precedence: bulk
Southern Ural State University
Division of WAN Technologies
Alexey E. Zelenin, Network Engineer
Phone:+7(3512)654992
E-mail:
[email protected]