Description
Disclaimer
- I have read and understood the disclaimer.
- I plan to implement the feature myself.
Akvorado version
1.11.3
Feature description
Good afternoon,
Once again, I would like to thank you for an excellent product that greatly helps with diagnostics and monitoring.
I have encountered an issue that cannot be resolved at the hardware level, and I have not found a way to address it in Akvorado.
The issue is as follows: when sending IPFIX from Juniper devices, one of the IPFIX fields contains data about the SRC AS, which is derived from the routing table. However, in many cases, these devices do not have a FullView, so they obtain data from the default route, which results in an incorrect origin being assigned. The same situation occurs when data is sent from an interface that belongs to a routing instance.
Is there a way in Akvorado (goflow) to optionally disable the analysis of the SRC AS field and instead use the same mechanism as in SFlow, where the analysis is based on external databases such as the ASN database from MaxMind?
It is not possible to disable this field at the Juniper configuration level. There are two available data transmission options, but neither of them correctly transmits the information.
For example, data from one of the interfaces:
whois 77.83.53.0 | grep origin
origin: AS209739
I appreciate your response in advance.