查看设备是否发送Netflow包
$ sudo tcpdump -n udp port 2055
$ sudo apt-get install flow-tools
mkdir /opt/netflow flow-capture -z 6 -n 143 -e 8928 -V 5 -w /opt/netflow 0/0/2055
创建netflow数据库,创建flows表
CREATE TABLE `flows` ( `FLOW_ID` int(32) NOT NULL AUTO_INCREMENT, `UNIX_SECS` int(32) unsigned NOT NULL default '0', `UNIX_NSECS` int(32) unsigned NOT NULL default '0', `SYSUPTIME` int(20) NOT NULL, `EXADDR` varchar(16) NOT NULL, `DPKTS` int(32) unsigned NOT NULL default '0', `DOCTETS` int(32) unsigned NOT NULL default '0', `FIRST` int(32) unsigned NOT NULL default '0', `LAST` int(32) unsigned NOT NULL default '0', `ENGINE_TYPE` int(10) NOT NULL, `ENGINE_ID` int(15) NOT NULL, `SRCADDR` varchar(16) NOT NULL default '0', `DSTADDR` varchar(16) NOT NULL default '0', `NEXTHOP` varchar(16) NOT NULL default '0', `INPUT` int(16) unsigned NOT NULL default '0', `OUTPUT` int(16) unsigned NOT NULL default '0', `SRCPORT` int(16) unsigned NOT NULL default '0', `DSTPORT` int(16) unsigned NOT NULL default '0', `PROT` int(8) unsigned NOT NULL default '0', `TOS` int(2) NOT NULL, `TCP_FLAGS` int(8) unsigned NOT NULL default '0', `SRC_MASK` int(8) unsigned NOT NULL default '0', `DST_MASK` int(8) unsigned NOT NULL default '0', `SRC_AS` int(16) unsigned NOT NULL default '0', `DST_AS` int(16) unsigned NOT NULL default '0', PRIMARY KEY (FLOW_ID) ) ENGINE=MyISAM DEFAULT CHARSET=utf8;
创建数据库插入脚本
$ cat flow-mysql-export #!/bin/bash flow-export -f3 -u "username:password:localhost:3306:netflow:flows" < /flows/router/$1
获取Netflow信息,执行插入任务
mkdir -p /srv/flows/router flow-capture -w /srv/flows/router -E5G 0/0/2055 -R /srv/bin/flow-mysql-export
原文出处:Netkiller 系列 手札
本文作者:陈景峯
转载请与作者联系,同时请务必标明文章原始出处和作者信息及本声明。