How to measure traffic to an ASN?

RouterOS Forwarding Protocols
1

Hi,
I’m trying to get a peering agreement with a local Content provider, but I need to measure the traffic from my ASN to their ASN. What method or program do you use to measure ASN to ASN traffic?

Thanks,

2

nfacct is what you need

3

For that purpose (and many others!) Netflow is your friend.

Try nfsen (nfsen.sourceforge.net).

4

Will those tools work, though, with Mikrotik flows as they don’t include the ASN?

5

Traffic-Flow version is the difference, higher version of traffic flow standard will provide more information, its also depending on having your netflow collector set to save that information when received as well.

6

Unfortunately RouterOS does not include ASN information in Netflow no matter what version.

With any luck we might see this in RouterOS v7.

If you want it email support@mikrotik.com and let them know. The more people that ask for it the more likely we get it.

7

with ‘offline CDR meditation’ you can do a daily measurement with traffic flow.
Log the traffic, list the prefixes on your and their side, calculate the SUM for those prefixes.
I think, a script what running daily can do this job withing 5 minutes.

Another possiblity to manually extend the logged traffic flow with the ASNs fetched from Maxmind (or yours) hash table.

8

What were you trying to accomplish there that can’t just be done with NetFlow into a standard NetFlow collector, aside from the ASN business? IPs → ASNs that aren’t collected from your ASN’s perspective can be worthless. There are many situations where this data is different or not complete.

9

I agree, that those information is not 100% accurate, since not following it, if the routing changes.
However until your NetFlow source not include the ASN, IMHO the most accurate to export your routing table periodically (daily or hourly) and do the prefix/asn assignment based on that period.

Or you have better idea?

10

Also, can we have S-Flow?

11

so do we have any solution in this case?
using scheduler or whatever?

i can see there is a feature: “nfasnupd”
https://metacpan.org/pod/Net::NfDump

it might help to convert empty AS number and replace with the correct one..

nfcapd -x “nfasnupd %d/%f”

but i still dont know how do we modify script of nfdump and nfsen

12

I use ntopng to capture stats via IPFIX from my CCR.

Screenshot 2021-05-14 142624.png
2.png

13

How is NTOPNG filling in the known-missing ASN information?