ng_netflow: testers are welcome

[Gleb Smirnoff]

On Mon, Feb 23, 2004 at 10:32:42PM +0300, Vasenin Alexander aka BlackSir wrote:
V> But there is bug in "ipfw tee" - packets is always immediately accepted
V> instead of continue going through the ruleset, so tee must be the last
V> rule(So, ng_netflow never see packets that denied by ipfw before tee rule).
V> Maybe there is way to use 'divert'? I've tried - packets going to divert
V> socket,then ng_netflow... and never come back... Actually I'm not quite
V> understand mechanism of returning from divert - ng_ksocket have only one
V> hook...

This behavior of "ipfw tee" is even mentioned in BUGS. However
there have been posted a fix in kern/61259. I have not tested it,
you can try.

Another way of solving "ipfw tee" problem would be writing a netgraph
node with 2 hooks, first one sends received data back into itself and 
a copy towards second hook. ng_ksocket with divert should be connected
to first hook, and ng_netflow to second one. You can call this node
ng_echotee :)
:))) When I typed it, I've understood that this behavior can be achieved
combining ng_tee and ng_echo from base system. Really netgraph rocks!

V> 2Gleb: It would be pleasure for me to write a little example based on our
V> discussion for README if you need.

I'd be glad if you show me your current netgraph setup script. Surely
I can reproduce it myself, but live example would be better than imaginary.

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE