[Bug 297172] ng_netflow exports unicast routing information instead of multicast forwarding info for multicast flows

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297172

            Bug ID: 297172
           Summary: ng_netflow exports unicast routing information instead
                    of multicast forwarding info for multicast flows
           Product: Base System
           Version: 15.1-RELEASE
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]

While investigating NetFlow accounting for IPTV multicast traffic, I observ=
ed
that exported NetFlow records contain output interface and next-hop informa=
tion
derived from the unicast routing table rather than from the multicast
forwarding path.

The test environment consists of:

              Internet
                  |
              vlan02
                  |
             IGMP Proxy
                  |
              vlan05
                  |
              IPTV STB

The IPTV stream is received on vlan02 and forwarded by the multicast forwar=
ding
subsystem to vlan05 (IPTV STB).

Observed NetFlow record

Example exported flow:

Source Address      : 217.166.225.124
Destination Address : 224.0.251.124

INPUT_SNMP          : 8
OUTPUT_SNMP         : 13
IP_NEXT_HOP         : 185.93.175.230

where

interface 8 is vlan02
interface 13 is pppoe0 (instead of vlan05)

Experiments

To eliminate the possibility that another NetFlow instance produced the
exported flow, all NetFlow nodes were disabled except the node attached to
vlan05.

ngctl list showed:

netflow_vlan05

with no active NetFlow nodes attached to any other interface.

Despite this, the exported multicast flow still contained:

INPUT_SNMP  =3D 8
OUTPUT_SNMP =3D 13
IP_NEXT_HOP =3D 185.93.175.230

This indicates that these values are generated by the ng_netflow implementa=
tion
itself and are not inherited from another NetFlow instance.

From the code, it seems that OUTPUT_SNMP and IP_NEXT_HOP are derived from a
unicast routing lookup even if this is multicast.

It is unclear whether this is intended behaviour or an omission in the
multicast handling. The ng_netflow manual page does not describe how multic=
ast
traffic is exported or how these fields are determined for multicast flows.

--=20
You are receiving this mail because:
You are the assignee for the bug.=