ng_netflow: testers are welcome

[Vasenin Alexander aka BlackSir]

YES! IT WORKS!
All I've need - just create ksocket with inet/rawip/divert hook connected to
ng_netflow iface0 hook (mkpeer netflow: ksocket iface0 inet/raw/divert),
then "msg netflow: setdlt { iface=0 dlt=12 }" (Raw ip instead of ethernet),
then "msg divert: bind inet/0.0.0.0:8888". And after all add ipfw rule "tee
8888 ip from any to any in"(One may need "via $oif") instead of final allow
(or, better, before it).
But there is bug in "ipfw tee" - packets is always immediately accepted
instead of continue going through the ruleset, so tee must be the last
rule(So, ng_netflow never see packets that denied by ipfw before tee rule).
Maybe there is way to use 'divert'? I've tried - packets going to divert
socket,then ng_netflow... and never come back... Actually I'm not quite
understand mechanism of returning from divert - ng_ksocket have only one
hook...

Great thanks to Julian & Gleb & all who helped!
2Gleb: It would be pleasure for me to write a little example based on our
discussion for README if you need.
	Vasenin Alexander aka BlackSir

> -----Original Message-----
> From: owner-freebsd-isp at freebsd.org
> [mailto:owner-freebsd-isp at freebsd.org]On Behalf Of Gleb Smirnoff
> Sent: Monday, February 23, 2004 1:43 PM
> To: Julian Elischer
> Cc: freebsd-isp at freebsd.org; Bjoern A. Zeeb; Vasenin Alexander aka
> BlackSir; freebsd-net at freebsd.org
> Subject: Re: ng_netflow: testers are welcome

> On Sun, Feb 22, 2004 at 03:17:38PM -0800, Julian Elischer wrote:
> J> you can open a divert socket as a netgraph node by openning a ksocket
> J> node with protocol 'divert'.

> Really one can use "ipfw tee" to pass demasqueraded traffic to
> ng_netflow.