Large BGP Communities support

[pierky]

Hi Paolo,

is there any plan to add support for Large BGP communities (1)? ExaBGP and Cisco (IOS XR) already implemented it (2), other vendors are moving too. It looks like this time is the one to have vendors implementing them!

Thanks

1. https://tools.ietf.org/html/draft-heitz-idr-large-community-03
2. http://largebgpcommunities.net/implementations/

[paololucente]

Ciao Pier Carlo,

You raise a very good point. Skimming through the draft, it looks the implementation will not require much effort. Let me spend some time on this later in the week. As a result of this PR now http://largebgpcommunities.net/implementations/ shows pmacct as 'planned'.

[job]

Commits d1937d4 (1), cde5dcd (2) and 97d02ba (3) produce Large BGP Community support

[pierky]

@job Only on bgp_table_dump_file's output as far as I can understand from the code. Yesterday @paololucente told me he was still working on this to extend support to the rest of the tool.

[job]

@pierky yes there is still additional work to do for all outputs.

[paololucente]

Dears,

With commit 514c44e this is now done. My bad i did not reference this issue in the commits to link all nicely.

Large Communities are both part of the output (log or dump) of pmbgpd and are a new aggregation primitive.

All is QA'd in lab and anything unexpected is at this point a bug :)

Cheers,
Paolo

[pierky]

Hi @paololucente,

I'm having some issues with the pmacctd 1.6.2-git (20161016-00) version, compiled from master.

I have an host (192.0.2.3) pinging the host where pmacctd runs (192.0.2.5). I also have a BGP speaker that announces 192.0.2.2/32, 192.0.2.3/32 and 192.0.2.4/32 with large communities.

I start with a simple configuration:

interface: eth0

logfile: /etc/pmacct/log

bgp_daemon: true
bgp_daemon_ip: 192.0.2.5
bgp_daemon_port: 179
bgp_daemon_max_peers: 10
bgp_src_as_path_type: bgp
bgp_agent_map: /etc/pmacct/bgp_agent_map.conf
bgp_table_dump_file: /etc/pmacct/bgp.log
bgp_table_dump_refresh_time: 60
bgp_src_lrg_comm_type: bgp

pmacctd_as: bgp
pmacctd_net: bgp

plugins: print[plugin1]
print_output_file[plugin1]: /etc/pmacct/plugin1.out
print_refresh_time[plugin1]: 3
print_output[plugin1]: csv
aggregate[plugin1]: proto, src_host, src_port, dst_host, dst_port

I got the following:

# cat pmacct/plugin1.out
SRC_IP,DST_IP,SRC_PORT,DST_PORT,PROTOCOL,PACKETS,BYTES
192.0.2.3,192.0.2.5,0,0,icmp,2,168
192.0.2.5,192.0.2.3,0,0,icmp,2,168

# cat pmacct/bgp.log
{..., "ip_prefix": "192.0.2.2/32", ..., "lcomms": "65536:1:1", ...}
{..., "ip_prefix": "192.0.2.3/32", ..., "lcomms": "65537:1:1", ...}
{..., "ip_prefix": "192.0.2.4/32", ..., "lcomms": "65538:1:1", ...}

Everything is fine.

Then I change the aggregate[plugin1], I add src_lrg_comm and lrg_comm:

aggregate[plugin1]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm

pmacctd starts and after 3 seconds quits. Log says:

INFO ( plugin1/print ): plugin_pipe_size=4096000 bytes plugin_buffer_size=240 bytes
ERROR ( plugin1/print ): plugin_buffer_size is too short.

I set plugin_buffer_size: 1000, it starts and does not quit this time, but I have odd output from the plugin:

# cat pmacct/plugin1.out
SRC_IP,DST_IP,SRC_PORT,DST_PORT,PROTOCOL,PACKETS,BYTES
,192.0.2.5,0,0,icmp,2,168
,,0,0,ip,0,0
,,0,4,ip,0,0
,,0,0,ip,0,0

# cat pmacct/plugin1.out
SRC_IP,DST_IP,SRC_PORT,DST_PORT,PROTOCOL,PACKETS,BYTES
,,0,0,icmp,1,84
,,0,2,ip,0,0
,,0,0,ip,0,0
,,0,0,icmp,1,84
,,13109,14903,ipv6-icmp,0,0
,,0,0,ip,0,0

What am I missing?

Many thanks

[pierky]

I have some news about this issue.

In order to be sure my config was fine with regards of BGP I tried to originate a standard community too from ExaBGP and to use it in plugins' aggregate:

plugin_buffer_size: 1000

plugins: print[plugin1], memory[plugin2]
print_output_file[plugin1]: /etc/pmacct/plugin1.out
print_refresh_time[plugin1]: 3
print_output[plugin1]: csv
aggregate[plugin1]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm, std_comm, src_std_comm

plugins: memory[plugin2]
imt_path[plugin2]: /etc/pmacct/plugin2.pipe
aggregate[plugin2]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm, std_comm, src_std_comm

This is what I got in the BGP table dump:

{..., "event_type": "dump_init", "dump_period": 60}
{..., "event_type": "dump", "ip_prefix": "192.0.2.2/32", ..., "lcomms": "65536:1:1", ...}
{..., "event_type": "dump", "ip_prefix": "192.0.2.3/32", ..., "comms": "2:2", "lcomms": "65537:1:1", ...}
{..., "event_type": "dump", "ip_prefix": "192.0.2.4/32", ..., "lcomms": "65538:1:1", ...}
{..., "event_type": "dump_close", "entries": 3, "tables": 1}

So, 192.0.2.3/32 was also tagged with 2:2.

This is what I got in the plugins' output:

# cat pmacct/plugin1.out
COMMS,SRC_COMMS,SRC_IP,DST_IP,SRC_PORT,DST_PORT,PROTOCOL,PACKETS,BYTES
2:2,,192.0.2.5,192.0.2.3,0,0,icmp,3,252
,2:2,192.0.2.3,192.0.2.5,0,0,icmp,3,252

# pmacct -p /etc/pmacct/plugin2.pipe -s -e
COMMS  SRC_COMMS  LCOMMS       SRC_LCOMMS    SRC_IP         DST_IP         SRC_PORT  DST_PORT  PROTOCOL  PACKETS  BYTES
0       2:2         0             65537:1:1      192.0.2.3      192.0.2.5      0         0         icmp      10       840
2:2     0           65537:1:1     0              192.0.2.5      192.0.2.3      0         0         icmp      10       840

For a total of: 2 entries

LCOMMS and SRC_LCOMMS was totally missing from the print's output, while COMMS and SRC_COMMS was fine.
In the memory plugin both standard and large communities was fine.

Then I tried to modify the memory plugin's aggregate by removing std_comm and src_std_comm primitives:

aggregate[plugin2]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm

This is what I got:

# pmacct -p /etc/pmacct/plugin2.pipe -s -e
LCOMMS  SRC_LCOMMS  SRC_IP        DST_IP       SRC_PORT  DST_PORT  PROTOCOL    PACKETS BYTES
0        0            192.0.2.5     192.0.2.3    0         0         icmp        4       336
0        0            192.0.2.3     192.0.2.5    0         0         icmp        4       336

For a total of: 2 entries

LCOMMS and SRC_LCOMMS was there but this time they did not contain any value, even if BGP table was the same as above.

[paololucente]

Hi @pierky,

There were a couple of commits. Specifically bc6d273 relates to your point of not seeing Large Communities as part of CSV print plugin output. And 29f5510 is to properly honour 'bgp_src_lrg_comm_type: bgp' and 'bgp_src_std_comm_type: bgp' in the config - both should be there and it is intended that default is none, ie. do not present any value. The rest i could not really reproduce: it may help having access, if possible, to your environment. Any chance you can give it another round of test?

Paolo

[pierky]

@paololucente, now the print plugin's output includes LCOMMS and SRC_LCOMMS columns but I'm still experiencing issues with the values.

If I use only src_lrg_comm, lrg_comm primitives (see config below):

• the memory plugin produces an output that is consistent with the traffic but that does not include the large communities values;
• the print plugin produces an inconsistent output (missing src/dst IP addresses, wrong protocols, ...).

If I add std_comm, src_std_comm or both primitives to the aggregate statements, the plugins show an output which is consistent with the traffic and which includes the correct large communities values under the LCOMMS and SRC_LCOMMS columns.

I send you a email to see if we can arrange a remote session.

Using src_lrg_comm, lrg_comm only, without std comms.

Configuration:

interface: eth0

logfile: /etc/pmacct/log

bgp_daemon: true
bgp_daemon_ip: 192.0.2.5
bgp_daemon_port: 179
bgp_daemon_max_peers: 10
bgp_src_as_path_type: bgp
bgp_agent_map: /etc/pmacct/bgp_agent_map.conf
bgp_table_dump_file: /etc/pmacct/bgp.log
bgp_table_dump_refresh_time: 60
bgp_src_lrg_comm_type: bgp
bgp_src_std_comm_type: bgp

pmacctd_as: bgp
pmacctd_net: bgp

plugin_buffer_size: 1000

plugins: print[plugin1], memory[plugin2]
print_output_file[plugin1]: /etc/pmacct/plugin1.out
print_refresh_time[plugin1]: 3
print_output[plugin1]: csv
aggregate[plugin1]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm

imt_path[plugin2]: /etc/pmacct/plugin2.pipe
aggregate[plugin2]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm

Traffic: ping from 192.0.2.3 to 192.0.2.5 + a BGP session from 192.0.2.2.

memory plugin output:

# pmacct -p /etc/pmacct/plugin2.pipe -s -e
LCOMMS                  SRC_LCOMMS              SRC_IP           DST_IP           SRC_PORT  DST_PORT  PROTOCOL    PACKETS               BYTES
0                        0                        192.0.2.5        192.0.2.2        179       33364     tcp         1                     52
0                        0                        192.0.2.5        192.0.2.3        0         0         icmp        5                     420
0                        0                        192.0.2.3        192.0.2.5        0         0         icmp        5                     420
0                        0                        192.0.2.2        192.0.2.5        33364     179       tcp         1                     52

For a total of: 4 entries

print plugin output:

# cat pmacct/plugin1.out
LCOMMS,SRC_LCOMMS,SRC_IP,DST_IP,SRC_PORT,DST_PORT,PROTOCOL,PACKETS,BYTES
,,,,0,0,icmp,1,84
,,,,13109,14903,ipv6-icmp,0,0
,,,,0,0,ip,0,0
,,,,0,0,icmp,1,84
,,,,0,2,ip,0,0
,,,,0,0,ip,0,0

Using src_lrg_comm, lrg_comm + std comms.

Configuration:

...
aggregate[plugin1]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm, std_comm, src_std_comm
...
aggregate[plugin2]: proto, src_host, src_port, dst_host, dst_port, src_lrg_comm, lrg_comm, std_comm, src_std_comm

memory plugin output:

# pmacct -p /etc/pmacct/plugin2.pipe -s -e
COMMS                   SRC_COMMS               LCOMMS                  SRC_LCOMMS              SRC_IP           DST_IP           SRC_PORT  DST_PORT  PROTOCOL    PACKETS               BYTES
0                        0                        65536:1:1                0                        192.0.2.5        192.0.2.2        179       45604     tcp         15                    780
0                        0                        0                        65536:1:1                192.0.2.2        192.0.2.5        45604     179       tcp         15                    1223
0                        0                        0                        65537:1:1                192.0.2.3        192.0.2.5        0         0         icmp        1                     84
0                        0                        65537:1:1                0                        192.0.2.5        192.0.2.3        0         0         icmp        1                     84

For a total of: 4 entries

print plugin output:

# cat pmacct/plugin1.out
COMMS,LCOMMS,SRC_COMMS,SRC_LCOMMS,SRC_IP,DST_IP,SRC_PORT,DST_PORT,PROTOCOL,PACKETS,BYTES
,,,65537:1:1,192.0.2.3,192.0.2.5,0,0,icmp,3,252
,65537:1:1,,,192.0.2.5,192.0.2.3,0,0,icmp,3,252

[pierky]

@paololucente, after your last commit plugins' output looks fine!

I'll do more tests but I believe I can close this issue now.

Thanks for your support.

# pmacct -p /etc/pmacct/plugin2.pipe -s -e
LCOMMS                  SRC_LCOMMS              SRC_IP           DST_IP           SRC_PORT  DST_PORT  PROTOCOL    PACKETS               BYTES
0                        65537:1:1                192.0.2.3        192.0.2.5        0         0         icmp        1                     84
65537:1:1                0                        192.0.2.5        192.0.2.3        0         0         icmp        1                     84

For a total of: 2 entries

# cat /etc/pmacct/plugin1.out
LCOMMS,SRC_LCOMMS,SRC_IP,DST_IP,SRC_PORT,DST_PORT,PROTOCOL,PACKETS,BYTES
,65537:1:1,192.0.2.3,192.0.2.5,0,0,icmp,3,252
65537:1:1,,192.0.2.5,192.0.2.3,0,0,icmp,3,252