Flow-tools – a set of utilities for sending, collecting, processing, analyzing NetFlow data.
Install a collector that will receive statistics from sensors:
apt-get install flow-tools
Open the configuration file, for example, in the text editor nano (Ctrl+X to exit, y/n to save or cancel changes):
We comment everything and add a line at the end:
-w /var/log/flow -n 275 0/192.168.0.5/555
The -w switch specifies the directory where the files are stored, -n indicates the number of file rotations per day (i.e. 275 files will be saved each day, in case of large traffic, smaller files are then easier to analyze), 0 means that you need to listen to all network interfaces, 192.168.0.5 sensor address from which statistics will be received, 555 port to which data from the sensor will come.
Create a directory for the files:
Restart flow-capture to apply changes to the configuration file:
sudo service flow-capture restart
Check if flow-capture works like this:
netstat -lpnu|grep flow-capture netstat -anpl |grep 555
Errors and attempts to send statistics from sensors will be written in /var/log/syslog.
We can look like this:
sudo less /var/log/syslog | grep flow
If iptables is used, we will allow incoming UDP connections to port 555 to all:
sudo iptables -A INPUT -p udp --dport 555 -j ACCEPT
Either a specific address or network:
sudo iptables -A INPUT -s 10.0.0.0/24 -p udp --dport 555 -j ACCEPT