Linux – Generating and capturing Netflow on a Linux router

ciscolinuxnetflowrouter

We currently have a dual-NIC Ubuntu server at our data centre acting as the gateway router between our public networks and our ISP. We have a /30 cross connect network on the ISP-facing NIC, and one IP from each of the three networks attached to our interior-facing NIC.

I would like to configure network traffic statistic generation and collection on this server, using Cisco's Netflow protocols. This will allow me to confirm our ISP's billing, as well as break-down data flow within our network.

What tools or packages would you recommend to passively capture traffic statistics and record them for later processing? Extra points if the Netflow collector has a MySQL data-store connector.

Best Answer

For generating a tool like nprobe or fprobe will work fine as others have mentioned.

For collecting I like nfdump/nfsen. It doesn't use mysql, but it is really easy to work with and get data out of it in a machine readable form.

You probably don't want the full netflow data in mysql, instead it usually makes more sense to run an aggregation query and load the summary into mysql. Having 10,000,000 records in mysql is not going to be fun to work with, but inserting a daily or hourly summary of (ip,total flows,total bytes,total packets) works a lot better.

Related Solutions

Windows – Netflow Collector for Windows Free

ntop can act as a NetFlow collector and is available for Win32. You will have to recompile it by yourself though, or find pre-made builds (shouldn't be too hard, it's GPLv3 open source) since the provided build is limited to capturing 1000 packets per session.

Cisco – use Cisco ASA’s “NetFlow Security Event Logging” (NetFlow 9) for bandwidth monitoring

Security Event Logging is something different to what you're after. I believe you want straight NetFlow (v5 will do) - exported to some type of analyzer.

I've used, and can recommend, ManageEngine Netflow Analyzer: http://www.manageengine.com/products/netflow/download-free.html

Grab the free edition, and fire this up on a server somewhere. Make sure the server's firewall permits traffic on port 9996 (UDP). Then, use the following config on your ASA to export network flow data:

flow-export destination outside_interface_name <netflow analyzer IP> 9996
flow-export template timeout-rate 1
flow-export delay flow-create 10

access-list netflow-export extended permit ip any any

class-map netflow-export-class
 match access-list netflow-export

policy-map global_policy
 class netflow-export-class
  flow-export event-type all destination <netflow analyzer IP>

Note that in my example, I have assumed you have a global_policy policy-map defined.

Browse to Netflow Analyzer and log in. Netflow analyzer will break down the ASA output into source/destination connections, including traffic in megabytes per connection, and will even perform port analysis to show you the applications in use.

This makes it particularly easy to see when an employee is torrenting for instance. :-)

Best Answer

Related Solutions

Windows – Netflow Collector for Windows Free

Cisco – use Cisco ASA’s “NetFlow Security Event Logging” (NetFlow 9) for bandwidth monitoring

Related Topic