1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
!
! bgp_agent_map: NetFlow/sFlow agent to BGP peer map
!
! File syntax is key-based. Read full syntax rules in 'pretag.map.example' in
! this same directory.
!
! list of currently supported keys follow:
!
! 'bgp_ip' SET: IPv4/IPv6 session address or Router ID of the
! BGP peer.
! 'bmp_ip' An alias for 'bgp_ip' for mapping agents to the IPv4/
! IPv6 session address of BMP peers.
! 'bgp_port' SET: TCP port used by the BGP peer to establish the
! session, useful in NAT traversal scenarios.
! 'ip' MATCH: in nfacctd this is compared against the source
! IP address of the device originating NetFlow packets;
! in sfacctd this is compared against the AgentId field
! of received sFlow samples. Expected argument are an IP
! address or prefix (ie. XXX.XXX.XXX.XXX/NN). 0.0.0.0/0
! would match all IPv4 addresses; ::/0 would match all
! IPv6 addresses.
! 'in' MATCH: Input interface. In NFv9/IPFIX this is compared
! against IE #10 and, if not existing, against IE #252.
! 'out' MATCH: Output interface. In NFv9/IPFIX this is compared
! against IE #14 and, if not existing, against IE #253.
! 'filter' MATCH: incoming data is compared against the supplied
! filter expression (expected in libpcap syntax); the
! filter needs to be enclosed in quotes ('). In this map
! this is meant to discriminate among IPv4 ('ip', 'vlan
! and ip') and IPv6 ('ip6', 'vlan and ip6') traffic.
!
! Examples:
!
bgp_ip=192.168.1.1 ip=192.168.100.1
!
! The following maps something which any Netflow/sFlow agent to the specified
! BGP peer. This syntax applies also to non-telemetry daemons, ie. pmacctd and
! uacctd.
!
! bgp_ip=10.0.0.1 ip=0.0.0.0/0
!
! The following maps flows ingressing a specific interface of the NetFlow/sFlow
! agent to the specified BGP peer. This may be relevant to MPLS VPN scenarios.
!
! bgp_ip=192.168.1.1 ip=192.168.200.1 in=100
!
! In scenarios where there are distinct v4 and v6 BGP sessions with the same
! peer (by design or due to distinct BGP agents for v4 and v6), traffic can
! be directed onto the right session with a filter. pmacct needs somehow to
! distinguish the sessions to make the correlation properly work: if the IP
! address of the BGP sessions is the same, ie. pmacct is co-located with the
! BGP agent, the peers will need to have a different Router ID configured:
!
! bgp_ip=10.10.0.1 ip=0.0.0.0/0 filter='ip or (vlan and ip)'
! bgp_ip=fd00::1:8:0 ip=0.0.0.0/0 filter='ip6 or (vlan and ip6)'
|
