Installing and using flow-tools

Flow-tools – a set of utilities for sending, collecting, processing, analyzing NetFlow data.

Install a collector that will receive statistics from sensors:

apt-get install flow-tools

Open the configuration file, for example, in the text editor nano (Ctrl+X to exit, y/n to save or cancel changes):

nano /etc/flow-tools/flow-capture.conf

We comment everything and add a line at the end:

-w /var/log/flow -n 275 0/192.168.0.5/555

The -w switch specifies the directory where the files are stored, -n indicates the number of file rotations per day (i.e. 275 files will be saved each day, in case of large traffic, smaller files are then easier to analyze), 0 means that you need to listen to all network interfaces, 192.168.0.5 sensor address from which statistics will be received, 555 port to which data from the sensor will come.

Create a directory for the files:

mkdir /var/log/flow

Restart flow-capture to apply changes to the configuration file:

sudo service flow-capture restart

Check if flow-capture works like this:

netstat -lpnu|grep flow-capture
netstat -anpl |grep 555

Errors and attempts to send statistics from sensors will be written in /var/log/syslog.
We can look like this:

sudo less /var/log/syslog | grep flow

If iptables is used, we will allow incoming UDP connections to port 555 to all:

sudo iptables -A INPUT -p udp --dport 555 -j ACCEPT

Either a specific address or network:

sudo iptables -A INPUT -s 10.0.0.0/24 -p udp --dport 555 -j ACCEPT

See also:
Opening and analysis of files created with NetFlow
Configuring NetFlow on Cisco
Configuring sFlow on D-Link Switches
Setting up and using Traffic Flow in Mikrotik

Did my article help you? How about buying me a cup of coffee as an encouragement? Buy me a coffe.

Leave a comment

Leave a Reply