[Flow-tools] flow-tag

[Benjamin Bach]

On 9/24/07, Petre Mierlutiu <petru.mierlutiu at alcatel-lucent.ro> wrote:
>
> > Also this example worries me:
> >
> >  match 128.146/16 set-destination     0x010001
> >
> >
> > Does it mean that  the destination address will be overwritten?
>
> Definitely not! As it is explained before that same example in the
> manpage:
>   Following the match condition is one of set-destination, set-source,
>   or-destination, or-source to set or logically or a value to the
>
>   source or destination **tag**.
>
> So the line
>   match 128.146/16 set-destination 0x010001
> will set the destination tag, not the destination address. Anyhow, it
> wouldn't make much sense, as you are dealing with flows not with real,
> actual traffic.


True true.  But here in Denmark, though, every ISP is legally forced to keep
copies of all traffic two years back. Which is why I cannot mess with these
fields. It's part of our new great anti-terror thingy-dingy. Something where
politicians go and say "we need this! and this!" and don't have a real clue.

But can anyone enlighten me on the runtime of flow-tag.. I described my
question in the mail before this one. Right now I'm filtering out separate
copies per-subnet, because I need to do 4 different statistics for each
subnet, because I figured that flow-tag wouldn't be the way to go.

/ Benjamin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.splintered.net/pipermail/flow-tools/attachments/20070924/5dc7126b/attachment.htm