From: Kevin Nicastro (kevin@epoch.net)
Date: Wed Nov 13 2002 - 05:00:55 PST
I had to solve this problem years ago when we first started using cflowd. We were trying to use the tool on a nationwide backbone with multiple peering points, both public and private, across the country. The problem was that, although I could tell the packet was to be forwarded to any given peer ASN, I could not tell at which egress point it was. So I hacked the code.
It does not matter that flow packets are only counted on input interfaces. Each flow packet contains both a source interface and a destination interface. However, cflowd only builds arts tables based on the source interface. So I modified the code to build arts information on both the source interface AND the destination interface thereby counting each packet twice. To distinquish between an AS-matrix table which was collected based on destination interface, I did something arbitrary like added 1000 to the ifIndex value. For example:
ifIndex: 1 (Serial1/1/0 source interface)
ifIndex: 1001 (Serial1/1/0 destination interface)
The only function that needed modifying was
int CflowdCisco::AddFlow(const CflowdRawFlow & flow)
in file CflowdCisco.cc
Note, I don't know how your graphing/reporting program (like flowscan) would handle this change. This was before flowscan was released and I wrote my own code to parse the arts files and graphs them based on the java grapher that caida was using way back when (which we bought for about $300).
We do not used cflowd anymore.
Here is a copy of the modified function that we used. Note, it is from a very old version (2.1.a3). We eventually upgraded to 2.1.a9 but I cannot find the source code for that anymore. The first half is the original function, the second half is a repeat of the code changing inputIfIndex to outputIfIndex and adding 1000. Very simple.
-Kevin
=========================================================
int CflowdCisco::AddFlow(const CflowdRawFlow & flow)
{
uint16_t inputIfIndex;
uint16_t outputIfIndex;
if (! (flow.Index() & CflowdRawFlow::k_inputIfIndexMask)) {
inputIfIndex = 0;
}
else {
inputIfIndex = flow.InputIfIndex();
}
if (this->_tableIndex & k_cflowdProtocolTableMask) {
this->Interfaces()[inputIfIndex].ProtocolTable().AddFlow(flow);
}
if (this->_tableIndex & k_cflowdPortTableMask) {
cerr << "port table not yet implemented! {"
<< __FILE__ << ":" << __LINE__ << "}"
<< endl;
}
// update the net matrix
if (this->_tableIndex & k_cflowdNetMatrixMask) {
this->Interfaces()[inputIfIndex].NetMatrix().AddFlow(flow);
}
// update the AS matrix
if (this->_tableIndex & k_cflowdAsMatrixMask) {
this->Interfaces()[inputIfIndex].AsMatrix().AddFlow(flow);
}
if (this->_tableIndex & k_cflowdRawFlowMask) {
this->_flowLogger->AddFlow(flow);
}
// update the port matrix
if (this->_tableIndex & k_cflowdPortMatrixMask) {
this->Interfaces()[inputIfIndex].PortMatrix().AddFlow(flow);
}
// update the interface matrix
if (this->_tableIndex & k_cflowdInterfaceMatrixMask) {
this->Interfaces()[inputIfIndex].InterfaceMatrix().AddFlow(flow);
}
// update the nextHop table
if (this->_tableIndex & k_cflowdNextHopTableMask) {
this->Interfaces()[inputIfIndex].NextHopTable().AddFlow(flow);
}
// update the TOS table
if (this->_tableIndex & k_cflowdTosTableMask) {
this->Interfaces()[inputIfIndex].TosTable().AddFlow(flow);
}
this->_lastUpdated = time((time_t *)NULL);
/// Repeat the process this time recording the flow in Arts
/// under the ifIndex of the output interface + 1000. This
/// way you will know which direction the flow is travelling
/// Modified by Kevin Nicastro
if (! (flow.Index() & CflowdRawFlow::k_outputIfIndexMask)) {
outputIfIndex = 0;
}
else {
outputIfIndex = flow.OutputIfIndex();
}
outputIfIndex = (uint16_t) outputIfIndex + 1000;
if (this->_tableIndex & k_cflowdProtocolTableMask) {
this->Interfaces()[outputIfIndex].ProtocolTable().AddFlow(flow);
}
if (this->_tableIndex & k_cflowdPortTableMask) {
cerr << "port table not yet implemented! {"
<< __FILE__ << ":" << __LINE__ << "}"
<< endl;
}
// update the net matrix
if (this->_tableIndex & k_cflowdNetMatrixMask) {
this->Interfaces()[outputIfIndex].NetMatrix().AddFlow(flow);
}
// update the AS matrix
if (this->_tableIndex & k_cflowdAsMatrixMask) {
this->Interfaces()[outputIfIndex].AsMatrix().AddFlow(flow);
}
if (this->_tableIndex & k_cflowdRawFlowMask) {
this->_flowLogger->AddFlow(flow);
}
// update the port matrix
if (this->_tableIndex & k_cflowdPortMatrixMask) {
this->Interfaces()[outputIfIndex].PortMatrix().AddFlow(flow);
}
// update the interface matrix
if (this->_tableIndex & k_cflowdInterfaceMatrixMask) {
this->Interfaces()[outputIfIndex].InterfaceMatrix().AddFlow(flow);
}
// update the nextHop table
if (this->_tableIndex & k_cflowdNextHopTableMask) {
this->Interfaces()[outputIfIndex].NextHopTable().AddFlow(flow);
}
// update the TOS table
if (this->_tableIndex & k_cflowdTosTableMask) {
this->Interfaces()[outputIfIndex].TosTable().AddFlow(flow);
}
this->_lastUpdated = time((time_t *)NULL);
return(0);
}
"Strahler, Carsten" wrote:
> Hi,
>
> we use cflow and arts and everything is fine so far.
> But now I have to solve a special problem. We've a router with two
> eBGP-Peers.
> I'd like to sample both peers and get an AS-Matrix for in- and outgoing
> traffic for both peers.
> But the problem is that the tool 'artsases' generate only the matrix for the
> source interface.
> Therefore I'm not able to distinguish the outgoing traffic of both peers.
> Does anyone know a solution for this problem or an other tool ?
>
> regards
>
> ------------------------------------------------------------
> Carsten Strahler
>
> IP Planning
>
> Lambdanet Communications GmbH (AS 13237)
> Guenther-Wagner-Allee 13
> D-30177 Hannover (Germany)
>
> Phone +49 (0)511 / 84 88 12 86
> Mobile +49 (0)178 / 362 1286
> Fax +49 (0)511 / 84 88 12 59
> mailto:carsten.strahler@lambdanet.net
>
> web: www.lambdanet.net
> -----------------------------------------------------------
>
> _______________________________________________
> Cflowd mailing list
> Cflowd@caida.org
> http://login.caida.org/mailman/listinfo/cflowd
_______________________________________________
Cflowd mailing list
Cflowd@caida.org
http://login.caida.org/mailman/listinfo/cflowd
This archive was generated by hypermail 2.1.4 : Wed Nov 13 2002 - 05:20:05 PST