ipfix/netflow/sflow generator for Linux

Tue Dec 7 13:27:19 UTC 2010

I just retested nprobe and it has the same issue as most of the other tools.
It doesn't specify the InputInt and OutputInt properly. Yes, you can
statically set it but that will drastically skew the data in this
environment. I'm not against running multiple processes, I've just not found
a product that runs using multiple processes that does what I need to. 

I just noticed the ntop version in EPEL is fairly old, so I'll try to
compile the latest myself and see if it's more stable.

Also, FYI to anyone who is interested in this, I've opened a support ticket
with ipcad to fix the interface numbering issue.

http://tinyurl.com/32pjyfa

From: packetmonger at gmail.com [mailto:packetmonger at gmail.com] On Behalf Of
Darren Bolding
Sent: Monday, December 06, 2010 8:57 PM
To: Thomas York
Subject: Re: ipfix/netflow/sflow generator for Linux

We've used nprobe with good success, passing the flows to ntop, nfsen etc.

nProbe supports specifying the interface- so yes, you would have to run
multiple processes, but I believe it would work.

We went ahead and purchased the PF_RING driver as it significantly improved
the capture performance of our systems.

I'm assuming since you tried it, you really don't want to fire up a separate
process for each interface?  I'd love to hear what you thought about the
various tools and what you end up deciding on.

For us, we collect the data using nprobe and have had no problem getting
ntop to stably analyze those flows when pointed to it.  NFSEN is pretty damn
cool also.  We point various nprobe, netflow, sflow data at it with good
effect.

--D

On Mon, Dec 6, 2010 at 11:15 AM, Thomas York <straterra at fuhell.com> wrote:

At my current place of work, we use all Linux routers. I need to do some IP
accounting/reporting and am currently trying to use Scrutinizer. Scrutinizer
can use netstream, jstream, ipfix, netflow, and sflow data without qualms.
My only issue is that I can't seem to find any good software for Linux that
works with multiple interfaces to generate the flow information. I've tried
ndsad, nprobe, softflowd, host sflow, and ipcad without much luck. Most of
the software only works on one interface (which is useless as I need to do
accounting for numerous interfaces).

I've had the best luck with ipcad. The only thing that seems to not work
with it is that it doesn't correctly give the interface number in the flow
information. It refers to all interfaces as interface 65535. I've tried the
config option for ipcad to map an interface directly to an SNMP interface
ID, but that option of the config file seems to be ignored.

Ntop functionally does exactly what I need, but it's extremely buggy. It
segfaults after a few minutes, regardless of Linux distro or Ntop version.
So..any ideas on what I can do to get good flow information from our Linux
routers?

-- 
--  Darren Bolding                  --
--  darren at bolding.org           --