Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Debug messages related to Netflow parsing #417

Open
wants to merge 8 commits into
base: master
Choose a base branch
from

Conversation

vphatarp
Copy link
Contributor

Because of BGP policy changes I was seeing issues on the network which required me to filter out which Flow Destination IP addresses were not showing up any match on BGP tables learned by the BGP daemon. Earlier I used to debug this issue by dumping entire BGP tables on Nfacctd Collector and generating the flow matrix file with Ip Src/Dst listed and then doing a correlation between the 2.
I believe some debug commands related to Netflow parsing would ease debugging efforts needed and provide easier drill downs. It would also help to push the logs to ELK or similar Log Analyzers in order to debug the issue faster. I have added debug commands to the code which lists the following details:

  1. IP Address of the device that sourced the Netflow packet.
  2. BGP PeerIP which would be used to perform the lookups.(Helps in scenarios where RRs are used)
  3. BgpNextHop for the flow as seen in the Netflow packet.
  4. Source IP address of the Flow.
  5. Destination IP address of the Flow.
  6. Whether a lookup Match was found or not.

I have added a new cfg command for a conditional trigger of the debug commands. Only when debug and debug_netflow_parsing are both set to true, messages will be pushed to the log files. Currently debug messages have been added only to IPv4 and IPv6 flows.

Please let me know if any changes are needed from my end.
Regards,
vphatarp

Checklist

I have:

  • added the LICENSE template to new files
  • compiled & tested this code
  • included documentation (including possible behaviour changes)

Copy link
Member

@paololucente paololucente left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Vaibhav ( @vphatarp ),

Thanks very much for this contribution, especially important when troubleshooting / debugging correlation of flows and BGP / BMP. I will merge soon.

Paolo

@patrickjahns
Copy link

@paololucente
Any update on the process of merging the PR ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants