Its configuration file is pretty simple it’s built up by many lines containing the command line arguments of flow-capture: each line is used to run an instance of the program. Let’s edit the main configuration file, nf, where we tell flow-capture what we want to acquire and how we want to store it: cd /etc/flow-tools Acquiring dataįirst off, we need to acquire NetFlow data generated by our routers flow-tools is the package we need: apt-get install flow-tools The package contains 2 programs also, FlowTracker_Collector and FlowTracker_Grapher, which run periodically and build MRTG-like graphs, storing data in RRD databases. They can be used through a web-server and they let us analyze data collected by flow-capture. The FlowViewer package is splitted up on 3 CGIs: FlowViewer, FlowGrapher and FlowTracker. The flow-tools package is built up by a lot of components, many of them are transparently used by FlowViewer here I’ll focus on the flow-capture program, the one which acquires and collect the data.
There are two main packages involved in the solution: flow-tools, used to acquire and collect NetFlow data generated by our routers, and FlowViewer, used to process, view and paint them on nice graphs. Many tools have been developed to collect and analyze NetFlow data, here I chose flow-tools and FlowViewer packages, and I would like to show how to get them work on a fresh Debian 5.0 (Lenny) setup. NetFlow is a very useful tool/protocol to monitor network traffic’s patterns.
0 kommentar(er)
