Changes between Version 3 and Version 4 of netmon2017netflow


Ignore:
Timestamp:
Nov 15, 2017, 4:28:19 PM (7 years ago)
Author:
admin
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • netmon2017netflow

    v3 v4  
    11= Monitoring Netflow Using nfdump/nfsen =
     2You will install nfdump and nfsen in this hands-on.
    23
    3 $ sudo apt-get update
     4== install nfdump ==
     5
     6First install dependancies
     7{{{
    48$ sudo apt-get install build-essential autoconf
    59$ sudo apt-get install rrdtool mrtg librrds-perl librrdp-perl librrd-dev \
    6        libmailtools-perl php5 bison flex
     10       libmailtools-perl bison flex
     11}}}
    712
    813Now proceed to download and build. Note that only the last step (make install) has to be done as root.
    9 
     14{{{
    1015$ cd
    1116$ wget http://www.ws.nsrc.org/downloads/nfdump-1.6.13.tar.gz
    … …  
    1318$ cd nfdump-1.6.13
    1419$ ./configure --help      # optional, shows the build settings available
    15 $ ./configure --enable-nfprofile --enable-nftrack
     20$ ./configure --enable-nfprofile --enable-nftrack --enable-sflow
    1621$ make
    1722$ sudo make install
     23}}}
    1824
     25== Router Configuration ==
    1926
    20 Installing and setting up NfSen
     27== Testing nfcapd/sfcapd and nfdump ==
     28If your institutes access router uses netflow you shloud use nfcapd. If it uses sflow you should use sfcapd. You can find your router's flow expoter from this [wiki:netmon2017flowtype table]
    2129
    22 Download and compile. The patch is to fix a problem reported at http://sourceforge.net/p/nfsen/bugs/31/
     30=== For a netflow router ===
     31$ mkdir /tmp/nfcap-test
     32$ nfcapd -E  -p 9001 -l /tmp/nfcap-test
     33... after a while, a series of flows should be dumped on your screen.
    2334
     35Stop the tool with CTRL+C, then look at the contents of /tmp/nfcap-test
     36
     37$ ls -l /tmp/nfcap-test
     38You should see one or more files called nfcapd.<YEAR><MON><DAY><HR><MIN>
     39
     40Process the file(s) with nfdump:
     41
     42nfdump -r /tmp/nfcap-test/nfcapd.201Ywwxxyyzz | less
     43nfdump -r /tmp/nfcap-test/nfcapd.201Ywwxxyyzz -s srcip/bytes
     44
     45=== For a slow router ===
     46$ mkdir /tmp/sfcap-test
     47$ sfcapd -E  -p 9001 -l /tmp/sfcap-test
     48... after a while, a series of flows should be dumped on your screen.
     49
     50Stop the tool with CTRL+C, then look at the contents of /tmp/nfcap-test
     51
     52$ ls -l /tmp/sfcap-test
     53You should see one or more files called nfcapd.<YEAR><MON><DAY><HR><MIN>
     54
     55Process the file(s) with nfdump:
     56
     57nfdump -r /tmp/sfcap-test/sfcapd.201Ywwxxyyzz | less
     58nfdump -r /tmp/sfcap-test/sfcapd.201Ywwxxyyzz -s srcip/bytes
     59
     60== Installing and setting up NfSen ==
     61
     62Download and compile nfsen.
     63{{{
    2464$ cd
    2565$ wget http://www.ws.nsrc.org/downloads/nfsen-1.3.6p1.tar.gz
    2666$ tar xvzf nfsen-1.3.6p1.tar.gz
    2767$ cd nfsen-1.3.6p1
    28 $ wget http://www.ws.nsrc.org/downloads/nfsen-socket6.patch
    29 $ patch -p0 < nfsen-socket6.patch
     68$ perl -MCPAN -e 'install Socket6'
    3069$ cd etc
    3170$ cp nfsen-dist.conf nfsen.conf
    32 $ editor nfsen.conf
     71$ vi nfsen.conf
     72}}}
    3373
    3474Set the $BASEDIR variable
    35 
     75{{{
    3676$BASEDIR = "/var/nfsen";
     77}}}
    3778
    3879Set the users appropriately so that Apache can access files:
    39 
     80{{{
    4081$WWWUSER = 'www-data';
    4182$WWWGROUP = 'www-data';
     83}}}
    4284
    4385Set the buffer size to something small, so that we see data quickly. You would not do this on a production system.
    4486
    4587# Receive buffer size for nfcapd - see man page nfcapd(1)
     88{{{
    4689$BUFFLEN = 2000;
     90}}}
    4791
    4892Find the %sources definition, and change it to:
    4993
     94'''For a netflow router'''
     95{{{
    5096%sources=(
    51 'rtrX' => {'port'=>'9001','col'=>'#0000ff','type'=>'netflow'},
     97'accessrtr' => {'port'=>'9001','col'=>'#0000ff','type'=>'netflow'},
    5298 );               
     99}}}
     100
     101'''For a sflow router'''
     102{{{
     103%sources=(
     104'accessrtr' => {'port'=>'9001','col'=>'#0000ff','type'=>'sflow'},
     105 );               
     106}}}
    53107
    54108(substitute your group's router for rtrX, and either remove or comment out the existing sample sources).
    55109
    56110Change the HTMLDIR from /var/www/nfsen/ to /var/www/html/nfsen/
     111{{{
     112$HTMLDIR    = "/var/www/html/nfsen/";
     113}}}
     114Now save and exit from the file.
    57115
    58 $HTMLDIR    = "/var/www/html/nfsen/";
     116Deafault rrd tool version for nfsen is 1.5 but the latest version 1.6 therefore a slight configuration is needed
     117{{{
     118vi libexec/NfSenRRD.pm
     119}}}
    59120
    60 Now save and exit from the file.
     121Find the rrd tool setting from 1.5 to '''1.6'''
     122
    61123Create the netflow user on the system
    62 
     124{{{
    63125$ sudo useradd -d /var/nfsen -G www-data -m -s /bin/false netflow
     126}}}
    64127
    65128Install NfSen and start it
    66129
    67130Change directory back to just inside the source directory:
    68 
     131{{{
    69132$ cd
    70133$ cd nfsen-1.3.6p1
     134}}}
    71135
    72136Now, finally, we install:
    73 
     137{{{
    74138$ sudo perl install.pl etc/nfsen.conf
     139}}}
    75140
    76141Press ENTER when prompted for the path to Perl.
     142
    77143Install init script
    78144
    79145In order to have nfsen start and stop automatically when the system starts, add a link to the init.d diretory pointing to the nfsen startup script:
    80 
     146{{{
    81147$ sudo ln -s /var/nfsen/bin/nfsen /etc/init.d/nfsen
    82148$ sudo update-rc.d nfsen defaults 20
     149}}}
    83150
    84151Start NfSen
    85 
     152{{{
    86153$ sudo service nfsen start
    87 
    88 Check that nfcapd processes have been started:
    89 
    90 $ ps auxwww | grep nfcapd
     154}}}
    91155
    92156View flows via the web:
    … …  
    94158You can find the nfsen page here:
    95159
    96 http://pcX.ws.nsrc.org/nfsen/nfsen.php
    97 
    98 If you are working in pairs, then both of you should point your web browser to the PC which is receiving flows.
     160'''http://<your IP address>/nfsen/nfsen.php
    99161
    100162You may see a message such as:
    101163
    102 Frontend - Backend version mismatch!
     164'''Frontend - Backend version mismatch!'''
    103165
    104166This will go away if you reload the page, it's not a problem.
    105167
    106 Done! Move on to the third lab, exercise3-nfsen-top-talkers
    107 NOTES
    108 Adding sources
    109 
    110 If you had multiple routers in your network all sending flows to the same collector, you can either configure them to send to different ports on the collector, or you can tell nfsen the source IP address of each router. This allows nfsen to show distinct data from each source.
    111 
    112 DON'T DO THIS NOW as you only have a single router, but if you needed to, you would do it as follows:
    113 
    114     edit /var/nfsen/etc/nfsen.conf, and add the source(s), for example:
    115 
    116 %sources = (
    117     'rtrX'  => { 'port' => '9001', 'col' => '#0000ff', 'type' => 'netflow' },
    118     'rtrY'  => { 'port' => '9002', 'col' => '#00ff00', 'type' => 'netflow' },
    119     'gw'    => { 'port' => '9996', 'col' => '#ff0000', 'type' => 'netflow' },
    120 );
    121 
    122     Reconfigure NfSen.
    123 
    124 You will need to run this every time you modify /var/nfsen/etc/nfsen.conf:
    125 
    126 $ sudo /etc/init.d/nfsen reconfig
    127 
    128 You should see:
    129 
    130 New sources to configure : gw rtrY
    131 Continue? [y/n] y
    132 
    133 Add source 'gw'
    134 Add source 'rtrY'
    135 
    136 Start/restart collector on port '9002' for (rtr2)[pid]
    137 Start/restart collector on port '9996' for (gw)[pid]
    138 
    139 Restart nfsend:[pid]
    140 
    141 perl -MCPAN -e 'install Socket6'
    142168vi libexec/NfSenRRD.pm
    1431691.5 to 1.6