Netflow consists of three parts:
\nThe collector, which collects the connection data on a host,
\nthe capture, which receives data from collectors and writes them to disk in binary format,
\nthe dump tool, which presents the data<\/p>\n
We use fprobe as collector and nfcapd as capture tool:<\/p>\n
fprobe wants to be configured during the installation. It asks for the interface which should be listend upon and where the flow collector does listen. In our example, eth0 should be listend upon and the flow collector is situated on the same computer. Please use 127.0.0.1:9995 for that.<\/p>\n You can edit the frpobe file again:<\/p>\n \/etc\/default\/fprobe INTERFACE=\"eth0\" #fprobe can't distinguish IP packet from other (e.g. ARP) nfcapd needs to be configured by hand. \/etc\/default\/nfdump To change the destination folder of the capture files, change the hardcoded DATA_BASE_DIR in \/etc\/init.d\/nfdump<\/p>\n After that, start the services: After that, you can evaluate the resulting data Additional infos: Click to access Netflow.pdf<\/a><\/p>\n Click to access ripe50-plenary-tue-nfsen-nfdump.pdf<\/a><\/p>\n
\nsudo apt-get install fprobe nfdump
\n<\/code><\/p>\n
\n
\n#fprobe default configuration file<\/p>\n
\nFLOW_COLLECTOR=\"127.0.0.1:9995\"<\/p>\n
\nOTHER_ARGS=\"-fip\"
\n<\/code><\/p>\n
\nYou need to set nfcapd_start to yes:<\/p>\n
\n
\n# nfcapd is controlled by nfsen
\nnfcapd_start=yes
\n<\/code><\/p>\n
\n
\nsudo service fprobe stop
\nsudo service nfdump stop
\nsudo service fprobe start
\nsudo service nfdump start
\n<\/code><\/p>\n
\n
\ncd \/var\/cache\/nfdump
\nnfdump -R REPLACE_WITH_FIRST_FILE_BEGINNING_WITH_nfcapd.
\n<\/code>
\nYou can also define a filter with \" \", i.e. nfdump -R nfcapd.201510260926 \"port 3720\" or \"ip 8.8.8.8\"<\/p>\n
\nhttp:\/\/nfdump.sourceforge.net\/<\/p>\n