built in primitives could not get value in nfacctd about pmacct

[paololucente]

Hi @asas6559 ,

Is the exporter really encoding things like source / destination IP address and ports with a PEN? It looks odd; if you enable debug, you should be able to get a copy of the template in the log, can you paste it here?

Paolo

[asas6559]

Thanks for your reply, Paolo
I just still learning nfacctd.
Now,all the primitives in the template i can get their values successfully.I want to get the value in L2 header,L3 header,L4 header like the image below.(I tried built-in primitives or defined them in primitives.lst by packet_ptr both not effitive.)

I have a question, in nfacctd ,does the primitives can be analyzed must be in the payload?

Here is the template log.(all the field in template value get successfully in data packet)

2023-09-07T13:00:45Z DEBUG ( default/core ): NfV10 agent : 10.45.126.38:65536
2023-09-07T13:00:45Z DEBUG ( default/core ): NfV10 template type : flow
2023-09-07T13:00:45Z DEBUG ( default/core ): NfV10 template ID : 65535
2023-09-07T13:00:45Z DEBUG ( default/core ): -------------------------------------------------------------
2023-09-07T13:00:45Z DEBUG ( default/core ): | pen | field type | offset | size |
2023-09-07T13:00:45Z DEBUG ( default/core ): | mypen | 253 [253 ] | 0 | 16 |
2023-09-07T13:00:45Z DEBUG ( default/core ): | mypen | 254 [254 ] | 16 | 16 |
2023-09-07T13:00:45Z DEBUG ( default/core ): | mypen | 251 [251 ] | 32 | 2 |
2023-09-07T13:00:45Z DEBUG ( default/core ): | mypen | 252 [252 ] | 34 | 2 |
2023-09-07T13:00:45Z DEBUG ( default/core ): -------------------------------------------------------------
2023-09-07T13:00:45Z DEBUG ( default/core ): Netflow V9/IPFIX record size : tbd

[paololucente]

Hi @asas6559 ,

The Source and Destination address that you highlight in Wireshark, ie. the exporter address and the collector address, are not part of NetFlow / IPFIX:

• The exporter IP address you can get with the peer_src_ip primitive;
• the collector IP address is not available as a primitive but you could use a tag, just an idea;

When you say L2/L3/L4 headers, do you refer to the NetFlow / IPFIX flows or to the IP packets transporting the NetFlow / IPFIX data? nfacctd does collect only NetFlow / IPFIX data in the payload, yes. pmacctd does collect packets on the wire (and does not parse NetFlow / IPFIX).

Paolo

[asas6559]

Hi @paololucente ,

I get the exporter IP successfully by using peer_src_ip.

Thanks!