prefix-to-AS resolution feature/enhansment about as-stats HOT 15 CLOSED

For sFlow, you can check out my fork of Elisa Jasinska's module: https://github.com/JackSlateur/perl-net-sflow

It can be used gracefully with as-stats
It simply rebuilds ASN information based on IP addresses

from as-stats.

@manuelkasper : if you want such feature, I can provides you a patch that implements my module, optionally, for all flows

I don't know if it is relevant for as-stats, so it's up to you to take the decision :)

from as-stats.

@JackSlateur If you feel like implementing this, then sure, you're welcome! I currently don't have time to devote to AS-Stats myself, and I'm not using it myself anymore (due to no longer working at an ISP), so AS-Stats is pretty much at the mercy of users and contributors, and all I can do is merge pull requests after a very cursory check ;)

from as-stats.

@manuelkasper as-stats really helped me to quickly and easily grasp the world of netflows, providing useful and eye-candy graphs. too sad to hear that you will not be able to fuhrer expanded it. it remains a unique and handy tool. thank you.

@JackSlateur thanks for the feedback. such a patch/enhancement would be great for as-stats.

from as-stats.

@JackSlateur it'd be great to see a patch for this, or some clear instructions on how to use your module with as-stats

from as-stats.

Could you test the patched version (https://github.com/JackSlateur/AS-Stats), which support for netflow v5 ?

from as-stats.

I only have sFlow available, if that will work then I'm happy to test it for you.

from as-stats.

For sFlow, I'll have to commit some small code upstream sFlow.pm, as it currently do not push the required data down the stack

from as-stats.

I can drop in your forked sFlow.pm to the perl directory if that's all thats needed?

from as-stats.

@JackSlateur great news, especially for all those poor MikroTik users. It may take some time before I report back, but I will.

from as-stats.

So far, I've placed ip2as.pm under the bin directory as an executable. I've also placed ip2asn.json under the www directory next to asinfo.txt.

Are these the correct locations for those two files?

I created a custom ip2asn.json for our wireless/private BGP network with the following command:
vtysh -c "sh ip bgp" | grep \/ | cut -c 4-20,60-600 | sort | uniq | sed 's/ 0 //g' | sed 's/ / /g' | grep " i" | awk '{printf "\""$1"\": \""$(NF-1)"\", "}' | sed 's/^/{/' | sed 's/, $/}/'

each bgp/router in our network contains all AS/prefix information.

and switched the MikroTik routers to NetFlow v5.

from as-stats.

It does not seem to work.. the working SupperQuagga/ozonet are pmacctd/netflow_v9. the rest are MikroTik/netfllow_v5 routers.

I've checked the MikroTik netfloows on wireshark and they are indeed version5. Also ifindexs are properly set.

I am attaching the locally generated ip2asn.json file
ip2asn.zip

from as-stats.

there was a glitch in my local ip2asn.json file script generator. Fixing that glitch, the module works like a charm.

this is the revised vtysh/json script generator:
vtysh -c "sh ip bgp" | grep \/24 | cut -c 4-20,60-600 | sort | uniq | sed 's/ 0 //g' | sed 's/ / /g' | sed 's/ / /g' | grep " i" | sed 's/ i//g' | awk '{printf "\""$1"\": \""$NF"\", "}' | sed 's/^/{/' | sed 's/, $/}/'

thank you Jack

from as-stats.

@adamgent Please checkout my repo, I added the code for sFlow

from as-stats.

FWIW sflowtool can convert sflow to netflow

The following example shows sflowtool converting sFlow packets into NetFlow and sending the NetFlow
packets to a NetFlow collector specified by a host and port.
sflowtool -c netflow.inmon.com -d 9991 > /dev/null

from as-stats.