Version 1.0.0, 5 August 2009
Copyright © 2009 CESNET, z.s.p.o.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. The license can be found at GNU web page.
Table of Contents
- 1. Introduction
- 2. Installing Flexible FlowMon Probe
- 3. Configuration of the Flexible FlowMon Probe
- 4. Flexible FlowMon Probe
- 5. Using Flexible FlowMon Probe with Collector
- 6. Known HW and SW Limitations, Problems
- 7. FAQ
- 8. Contacting the Flexible FlowMon Team
- 9. Flexible FlowMon Development Team
- A. References
List of Figures
- 1.1. Flexible FlowMon Probe Monitoring Principle
- 1.2. NetFlow Principle
- 2.1. COMBO6X Card
- 2.2. Flexible FlowMon Probe Inserted at Mirror Port
- 2.3. Flexible FlowMon Probe Connected via Optical Splitter
- 2.4. Flexible FlowMon Probe Inserted in Line as a Repeater and Sending Data to Collector
- 2.5. Flexible FlowMon Probe COMBO-2XFP2 Card Port Numbers
- 4.1. Scheme of the 10 Gb/s Repeater Connection
- 5.1. NfSen Collector
List of Tables
- 2.1. COMBO Motherboard Compatibility
- 2.2. Tested GBICs
- 2.3. Supported Hardware
- 2.4. Supported Firmware
List of Examples
Table of Contents
The Flexible FlowMon Probe is a passive network monitoring device based on the COMBO6(X) technology. It is able to collect dynamic data about IP flows and export them to external collectors in the NetFlow (version 5 and 9) and IPFIX (IP Flow Information eXport) format. The probe has great contribution to the safety and reliability of your network. You can obtain information about attacks and data transfers going in and out of your network. The probe is remotely configurable using terminal interface.
So far, NetFlow data are mostly generated by IP routers. In contrast, our NetFlow probe is designed as an autonomous device working essentially as a T-splitter: when inserted into a network link, the incoming traffic is passed directly to the original destination and a separate copy of the link data is processed by the probe in parallel. From the network perspective, the probe can be classified as a repeater that is invisible at both the network and link layer.
Using a specialized probe for gathering data about IP flows has several advantages over the traditional router-based setup:
The probe does not appear as a hop in traceroute and thus remote attacks are virtually impossible.
Routers must concentrate on their main task - routing and forwarding. Consequently, the CPU cycles available for processing flow records are usually rather limited. The probe is much more flexible in this respect.
As a special case of the previous item, routers often enforce traffic sampling, especially on high-speed links. For some applications such as security analysis this is highly undesirable.
In contrast, a standalone monitoring probe is essentially a hidden device - invisible at both Layer 3 and 2 - dedicating all its resources to the tasks of flow record acquisition and processing.
monitoring of 10 Gbps port (currently we support 1 Gbps and 10 Gbps speeds, lower speeds can be set via phyterctl tool)
precise timestamps, active and inactive timeouts
input sampling (Each packet is sampled with a probability on selected input interface.).
repeater and splitter ports
export in NetFlow version 5, NetFlow version 9 and IPFIX format
exporting to more collectors at the same time
anonymization and per collector filtering
Table of Contents
You will need the following tools (programs, libraries):
gmake 3.80 or later
autoconf 2.59 or later
automake 1.4 or later
gcc 3.0 or later
libxml2 2.6.16 or later
libxslt 1.1.11 or later
libdbus 1.0.0 or later
pciutils (lspci) 2.2.2 or later
lsof 4.72 or later
Note
When you intend to develop new software based on Liberouter libraries, you will have to install also the devel sources of mentioned libraries, as well as the devel packages of Liberouter libraries.
All scripts are running in /bin/sh shell interpreter so all scripts were created with aim to portability. But on all testing machine the /bin/sh program was actually Bash (/bin/bash). Therefore we recommend using Bash as a default shell.
In order to build kernel drivers needed by Flexible FlowMon package you will need
fully configured Linux 2.4 or 2.6 kernel source tree. More installation
and compilation details about kernel drivers are available in the README
file inside base/drivers/linux
directory.
The Flexible FlowMon hardware has been designed to work on any computer running GNU/Linux or other "Unix-like" operating system. It has been tested only on computers that use the x86 family of processors. The hardware requirements necessary to run Flexible FlowMon are:
Intel Pentium or an equivalent x86 based PC
COMBO6X - 64-bit/66 MHz PCI-X bus
The "sandwich" consisting of COMBO card (COMBO6X) and an interface card (COMBO-2XFP2) fits into one PCI slot.
The following table expresses our experience with COMBO card compatibility to some motherboards.
Table 2.1. COMBO Motherboard Compatibility
| MB type | COMBO6X |
|---|---|
| Intel SE7501CW2 | compatible |
| Intel SE7520BD2D | compatible |
| Intel S5000VSA | compatible |
| Intel S5000PAL0 | compatible |
| Intel SE7525GP2 | incompatible |
| Intel SE7221BK1-E | incompatible |
The following table displays list of compatible GBICs, which we have tested. We have not found any non-compatible GBIC yet, all GBIC satisfying the SFP/XFP MSA specification should work.
Table 2.2. Tested GBICs
| Optical 10 Gbps (10GBASE-SR and 10GBASE-LR) for COMBO-2XFP2 cards |
|---|
| JDSU JXP-01SWAA1 (850 nm) |
| JDSU JXP-01LWAA1 (1310 nm) |
| Finisar FTRX-1411D3 (1310 nm) |
| Agilent (Avago) HFCT-721XPD (1310 nm) |
Flexible FlowMon Probe can be used with the COMBO cards described in the following table. COMBO6X cards need to have installed PCI bridge version c610.05.0c or higher (you can find details about PCI bridge and its version at http://www.liberouter.org/documents/pci_bridge_upgrade.php).
Table 2.3. Supported Hardware
| COMBO6X | a PCI-X (64/66) card with XILINX FPGAs | |
| COMBO-2XFP2 | add-on card with two XFP cages for 10GE interfaces and one SFP cage for 1GE interface |
Note
You can find more information about COMBO cards at http://www.liberouter.org/hardware.php.
Supported firmware depends on the type of card you use.
Table 2.4. Supported Firmware
| Mother Card | Add-on Card | Firmware | Features |
|---|---|---|---|
| COMBO6X | COMBO-2XFP2 | 01_03 | Network interface only for 10 Gbps |
| Maximal throughput up to 10 Gbps (on packets longer than 185 B) | |||
| Expiration of flow record can be controlled by TCP flags | |||
| Active timeout | |||
| Inactive timeout | |||
| Input sampling | |||
| Throughput 6200 K packets/s (packets size 64 B) or 800 K packets/s (packet size 1518 B) | |||
| 128 K flow records | |||
| Repeater |
The firmware supports processing of Ethernet and all basic IPv4 and IPv6 headers:
Ethernet L2 layer processing
MAC
802.1Q - Ethernet VLANs (cannot be recursive)
MPLS - MPLS packets (MPLS tags cannot be processed), EoMPLS
IPv4 and IPv6 protocols are recognized, other protocols are treated as unknown.
TCP, UDP, ICMP and ICMPv6 processing supported.
Flexible FlowMon software works on GNU/Linux OS with 2.4 and 2.6 versions of kernel. NetFlow v5, v9 and IPFIX protocols are supported. The software has been tested on computers running Red Hat Enterprise Linux, CentOS, Ubuntu and Debian.
After plugging COMBO card into your PCI slot, you should test connection between the card and your PC. We use lspci(8) utility for this purpose. lspci(8) is a utility for displaying information about all PCI buses in the system and all devices connected to them. For correct recognition of the COMBO card, you need to update the PCI ID Database used by lspci(8) or download pciutils-2.2.2 (a program collection containing lspci(8)) or later. If the lspci(8) output contains the following line your COMBO card is connected properly.
$lspci-d18ec:03:01.0 Ethernet controller: Cesnet, z.s.p.o. COMBO6X (rev 01)
Note
Numbers at the beginning of the line can differ.
There are three possibilities, how to insert the Flexible FlowMon Probe to the network - you can connect Flexible FlowMon Probe at a mirror port of some network device, utilize network tap or insert into a line as a repeater.
If you want to check Flexible FlowMon features you can simply mirror traffic from your router to the Flexible FlowMon Probe.
Another way how to connect the Flexible FlowMon Probe in your network is to utilize network tap, e.g. an optical splitter (see figure bellow).
In this case the Flexible FlowMon Probe works as a T-splitter: when inserted into a network link, the traffic is passed directly to the original destination and a separate copy of link data is processed by the probe in parallel. From the network perspective, the probe can be classified as a repeater that is invisible at both the network and link layer. Description of this repeater mode is in chapter Repeater.
The general rule for numbering card ports is that the ports closer to the motherboard (PCI slot) have lower numbers, e.g. the closest port has number 0, the next one number 1 etc. The repeater functionality is described in chapter Repeater. See figures bellow for examples:
Rx/Tx LED diodes at COMBO-2XFP2 cards represent the state of the link. Red diode has three modes:
- diode is off - this state should never happen
- diode is on - repeater is off or is not repeating data
- diode is blinking in 100 ms interval - repeater is on and is repeating data
The blinking green diode (in 100 ms interval) represents transmitting data from the card.
Liberouter project has a common centralized RPM repository for all projects. It is available on URL: https://www.liberouter.org/repo. Repository works over secured HTTPS channel. To obtain packages from it, you have to authorize yourself with login and password which you have received as our client. (Eventually, use login and password for SVN account.)
To make the standard tool yum(1) work properly with
our repository, you have to setup some configuration.
Add a new file liberouter.repo
to directory /etc/yum.repos.d/
with content:
[liberouter] name=Liberouter RPM repository baseurl=https://LOGIN:PASS@www.liberouter.org/repo/ enabled=1 gpgcheck=0
Note
Note: Instead of LOGIN and PASS write your real client login and password.
Now you can check your configuration using yum(1):
# yum repolist
...
liberouter Liberouter RPM repository enabled
...
Flexible FlowMon is distributed in form of several RPM packages.
Currently RPM packages for only CentOS 5.3 distribution are supported. Because
default CentOS linux kernel contains bug, that makes use of combo6 kernel modules
impossible, it is necessary to install and use provided kernel which fixes this bug.
Unfortunately this fixed kernel is older than current CentOS kernel and yum(1) will
not allow to downgrade package. This is possible with yum-allowdowngrade
plug-in so installation of this plug-in is also necessary. Run:
# yuminstallyum-allowdowngrade# yum--allow-downgradeinstallkernel-2.6.18-128.1.6.el5.slab_fix
Reboot to this new kernel after installation. Make sure, that computer reboots to this
kernel (check /etc/grub.conf).
Now proceed to install the fflowmon-1.0.0 package
# yum install fflowmon-1.0.0
This package will automatically install all necessary RPM packages for Flexible FlowMon 1.0.0:
- combo6-linux-driver-0.5.4
- combo6-linux-driver-udev-rules-0.5.4
- fflowmon-1.0.0
- fflowmon-config-1.0.0
- fflowmon-exporters-1.0.0
- fflowmon-fflowread-1.0.0
- fflowmon-fw-combo6x-xfp2-1.3.0
- fflowmon-handbook-1.0.0
- libcombo-1.0.0
- libcommlbr-1.0.0
- libcsfflow-1.0.0
- libsze2-1.0.0
- liberouter-tools-common-1.0.0
- liberouter-scripts-common-1.0.0
You can check installed files belonging to RPM packages by command:
$ rpm -ql <package>
Table of Contents
This chapter describes key configuration files for the Flexible FlowMon Probe. It explains purpose of the fflowmon.conf(5) configuration file used by Flexible FlowMon programs and describes its content.
This section describes
fflowmon.conf(5) configuration file placed in the
/etc/liberouter/ directory.
This configuration file is read by Flexible FlowMon Probe starting programs (
fflowmonlkm(1) and
fflowmon(1)) and by init script.
fflowmon(1) script uses it for reading default
values of Flexible FlowMon variables when the values are not set by
fflowmon(1) parameters. Init script set Flexible FlowMon Probe
completely according this configuration file.
fflowmon.conf(5) is actually a list of definition of environment variables.
VARNAME=VALUE
The file can contain blank lines or lines starting with '#' which are ignored by programs and can be used for comments.
You can freely modify this file and redefine default values of the probe settings.
Variable definitions are divided into several parts.
The first part contains variables specifying Flexible FlowMon Probe parameters.
INACTIVE_TIMEOUTValue of the inactive timeout in seconds.
This element specifies the inactive timeout in seconds, i.e., the amount of time after which a flow is classified as terminated and exported if no traffic has been seen for that interval. The accepted value varies for different COMBO cards, and can be between 0 seconds and approximately 1 hour.
ACTIVE_TIMEOUTValue of the active timeout in seconds.
This element specifies the active timeout, i.e., the time period after which any flow that is still classified as active must be exported in order to keep the collectors informed about the flow. Active timeout is given in seconds and can be between 0 seconds and approximately 45 minutes.
SAMPLING0_RATESampling rate on IBUF0. The set value means rate
1:valueand is the rate in which packets are sampled on input of interface 0.Sampling of incoming packets is the easiest way how to guarantee the measured bandwidth. It also helps to decrease the number of new flows during attacks when every incoming packets belongs to new flow.
SAMPLING0_TYPEType of sampling for IBUF0. Value 0 means constant, and value 2 random.
MTU0Maximum transmission unit (MTU) for IBUF0. The maximal frame length allowed.
REPEATER_ONDefault setting of the repeater. Value 0 means disabled, value 1 enabled and value 2 is for repeating only direction 2 (RX) to 1 (TX)
The second part contains variables specifying Flexible FlowMon exporter(s) settings. These variables are used by programs described in the Setting up Flexible FlowMon Probe section.
FFLOWMON_EXPNContains command to run exporter at the boot time or when the start exporting process selected and no exporter specified as parameter of fflowmon(1) script. The last character of the variable name is number of running exporter. The maximum number of exporters is 4 (numbered from 0 to 3) and it must be a gradual sequence (i.e. if you specify exporter 0 and 2, only number 0 will be started). More information about exporters can be found in fflowmon_nf5(1), fflowmon_nf9 or fflowmon_ipfix(1) man pages.
The third part contains variables specifying hardware parameters used for firmware design booting. These variables are used by all Flexible FlowMon start and control programs.
COMBO6_DEVICEThis variable contains the path to the combo6 device file.
FIRMWARE_PATHPath to the storage of firmware files. The value of this variable is set automatically according to configuration of installation process of package.
FIRMWARE_IDXHardware identification strings for the COMBO cards.
SZEDATA_BLOCKSSize of the memory for szedata2 driver. The size is specified in block size and block count.
SZEDATA_BLOCK_SIZESize of the memory for szedata2 driver. The size is specified in block size and block count.
The next part contains only one variable storing path to installed Flexible FlowMon programs.
This chapter describes starting Flexible FlowMon Probe by fflowmonlkm(1) and fflowmon(1) programs. These programs serve for a single start of the Flexible FlowMon Probe. If you wish to start the Flexible FlowMon Probe anytime you reboot the PC, please see section Flexible FlowMon init.d script.
After installation, the Flexible FlowMon tools (included man pages) are available as any other system tools. There are two main scripts to start the probe - fflowmonlkm(1) and fflowmon(1). Both scripts use fflowmon.conf(5) configuration file.
fflowmonlkm(1) script is used for
loading/removing Flexible FlowMon kernel modules. There are two main options
for this script. Option -l is used for loading
Flexible FlowMon kernel modules and option -r is used for
removing these modules. Script uses
lspci(8) utility to detect COMBO6 card.
When all kernel modules are loaded, csid(1) is able to detect the type of plugged cards and provide more detailed information.
You should get the following output on PC with installed
COMBO6X mother card and COMBO-4XFP2.2 add-on card:
$ csid combo6x xfp2.2 xc2vp30
Note
Chips may be different on some cards, so do not worry when there is a difference in the last part of the csid output
fflowmon(1) is the main start-up script for the
Flexible FlowMon Probe. The script boots firmware files (according to
FIRMWARE_PATH variable from the
fflowmon.conf(5)),
sets up the probe behavior and is able to start a NetFlow protocol exporter.
By default, the probe settings are set according to variables from
fflowmon.conf(5)
configuration file. Optionally you can define your own settings by options
given to the script. You can get more detailed information by
-h option or from man page:
$ fflowmon -h
$ man fflowmon
You should get the following output in the control buffer via dmesg(8) command after starting up the Flexible FlowMon Probe:
$ dmesg
combo6#0: device 0xf1010101 (Flexible_FlowMon) successfully attached
Note
Both scripts (fflowmon(1) as well as fflowmonlkm(1)) use lsof(8) tool to detect any process using COMBO device(s). In order to run scripts properly you need to install lsof(8) tool. lsof(8) is utility to get information about opened files in the system.
fflowmonctl(1) is the main tool for the
Flexible FlowMon Probe configuration. The tool can set parameters as active timeout, inactive
timeout, sampling settings and can enable/disable repeater. It can also display
the status off all these parameters and some more probe settings. You can get
more detailed information by -h option or from man page:
$ fflowmonctl -h
$ man fflowmonctl
You should get similar output as following, when using fflowmonctl(1) function for displaying status of Flexible FlowMon Probe parameters:
$ fflowmonctl -c status
Active timeout: 30.0 sec
Inactive timeout: 10.0 sec
Sampling type: constant
Sampling value: 1
Repeater: enabled
The Flexible FlowMon Probe logs important events to syslog using the user facility.
In order to have these log messages saved to a file, you must configure the syslog
daemon appropriately. In the case of the classical Unix syslogd daemon,
add the following line to /etc/syslog.conf:
user.* /var/log/user.log
Regarding your Linux distribution, search syslogd(8) and logrotate(8) documentation for the instructions on how to adjust log file rotation.
# fflowmonlkm -l
Loading Flexible FlowMon kernel modules for COMBO6X card.
combo6x 14208 1 szedata2_c6x
combo6core 18908 2 szedata2_c6x,combo6x
szedata2_c6x 11156 0
szedata2 14484 1 szedata2_c6x
$ fflowmon -ec collector.liberouter.org:60000
Note
Server collector.liberouter.org
is only an example name of the collector host which does not exist. Use,
please, your own (existing) collectors.
To make sure that the firmware was loaded correctly you can run csid(1):
$ csid -s
Board : combo6x
Addon0 : xfp2.2
Chip0 : xc2vp30
Channels : 3/3 (RX/TX)
Firmware : ok
SW : 0xf1010101
HW : 0x00010003
Text : Flexible_FlowMon
PCI brver: c610.05.0c
HW number detected by csid -s
reflects firmware version, e.g. HW : 0x00010003 reflects version
01_03.
To stop running exporter(s) and detach drivers, use
fflowmon(1) script with the
-s option:
$ fflowmon -s
Then you can remove Flexible FlowMon loaded kernel modules by the fflowmonlkm(1) script:
# fflowmonlkm -r
You can list all running exporters by system command ps(1) or you can use the start-up script:
$ ps aux | grep fflowmon
flowmon 3023 12:19 0:11 fflowmon_nf9 collector.liberouter.org 60000 -I 65535
flowmon 3105 12:26 0:04 fflowmon_nf5 -d localhost 3003
Start-up scripts are used to start a service (or a script) at
machine boot time. The Flexible FlowMon start-up script is used to automatically
start up the Flexible FlowMon Probe (to load kernel modules if necessary, boot
firmware and set up the probe behavior) anytime your PC is started up.
After installation, the script is implicitly prepared in
/etc/rc.d/init.d/ directory and enabled.
In the next section we describe, how to change these boot settings.
The start-up script uses all variables in fflowmon.conf(5) and calls fflowmonlkm(1) and fflowmon(1) scripts.
File
fflowmon.rcmust be present in the/etc/rc.d/init.d/directory.run chkconfig(8) and add fflowmon.rc as a new service
#chkconfig--addfflowmon.rcIn order to verify that everything is alright, you can search for fflowmon.rc in the list of services
#chkconfig--list| grepfflowmon.rcreboot your system
To remove the Flexible FlowMon service from chkconfig(8) management run:
#chkconfig--delfflowmon.rcreboot your system
You can use fflowmon.rc script for controlling the Flexible FlowMon Probe.
To stop Flexible FlowMon (kill running exporters) go to the
/etc/rc.d/init.d/ directory and
use the following command:
# ./fflowmon.rc stop
This command stops Flexible FlowMon but the service will be started
again during next reboot. To switch off the Flexible FlowMon service, in the
current run-level, use chkconfig(8) with off
option after service name (flowmon.rc in this case):
# chkconfig fflowmon.rc off
Note
You can find more detailed information in the chkconfig(8) man page.
Use option
status to show the current status of the Flexible FlowMon Probe . It displays all running Flexible FlowMon
exporter(s).
# ./fflowmon.rc status
Running Flexible FlowMon exporter(s):
-------------------------------------
/usr/bin/fflowmon_nf5 -c /dev/szedataII0 1 -d localhost 60003
/usr/bin/fflowmon_nf9 -c /dev/szedataII0 1 -d localhost 60001
/usr/bin/fflowmon_nf9 -c /dev/szedataII0 1 -d localhost 60002
Actual Flexible FlowMon probe parameters:
-----------------------------------------
Active timeout: 300.0 sec
Inactive timeout: 10.0 sec
Sampling type: constant (0)
Sampling value: 0
Repeater: enabled
In case you need to read data from HW and send them to the collector, you can run several instances of Flexible FlowMon exporters. Prior to running an exporter, you must start Flexible FlowMon Probe (load kernel modules and run fflowmon script).
A Flexible FlowMon exporter has the possibility to anonymize exported data, perform filtering, exporter sampling, use IPv4 or IPv6 for transport, etc. There are three versions of Flexible FlowMon exporter, fflowmon_nf5(1) for exporting in NetFlow version 5 export format, fflowmon_nf9(1) for exporting in NetFlow version 9 export format and fflowmon_ipfix(1) for exporting in IPFIX export format.
Example 4.1. Basic Exporting of NetFlow Records to the Collector
The following example shows running of three exporters, the first one exporting in NetFlow version 5 to port 60000 of the collector collector.liberouter.org, the second one in NetFlow version 9 to port 60001 of the same collector and the third one in IPFIX export format to port 60002 of the same collector. Parameter -d runs an exporter as a daemon.
$fflowmon_nf5 -d collector.liberouter.org:60000$fflowmon_nf9 -d collector.liberouter.org:60001$fflowmon_ipfix -d collector.liberouter.org:60002
Example 4.2. Exporting Anonymized NetFlow Records
Exporting NetFlow records with anonymized source and destination IP address by applying a block cipher.
$ fflowmon_nf9 -a aes:fields=src,dst -d collector.liberouter.org:60000
The exporter program will start sending flow records to the configured collector. To test that it is really the case, you can run a packet sniffer such as tcpdump(1) or ethereal(1), for example
#tcpdump -i interface 'dst port collector_port'#tcpdump -i eth0 'dst port 60000' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 12:23:41.656669 IP exporter.flowmon.org.32768 > collector.liberouter.org.60000: UDP, length 1424 12:23:41.667760 IP exporter.flowmon.org.32768 > collector.liberouter.org.60000: UDP, length 1424 12:23:41.667798 IP exporter.flowmon.org.32768 > collector.liberouter.org.60000: UDP, length 1420 ...
For further information please see exporters man pages:
$man fflowmon_nf5$man fflowmon_nf9$man fflowmon_ipfix
The repeater duplicates data from one port to another and vice versa.
It is necessary to state that the repeater is independent on the state of the rest of firmware and software as well. It is only dependent on state of the FPGA chip and therefore on the state of the host computer (power supply, firmware booting). So if you have connected the Flexible FlowMon Probe directly in the link as a repeater (see section Flexible FlowMon Probe Inserted in a Line), the built-in repeater starts to transfer packets in both directions between interfaces. If you choose this option it is recommended to use a UPS (uninteruptable power supply) so that the repeater is available during power failures.
The repeater may be enabled or disabled by fflowmon(1) program and its parameters, the default setting is according to fflowmon.conf(5) configuration file. Changing repeater settings is possible also with configuration tool fflowmonctl(1).
During reloading or resetting of a card, it takes about 4 seconds to start repeating again. Also monitoring starts 4 seconds later after reset or reload.
XFP2.2 card supports three modes for repeater. One is for disabling repeater. In the second are incoming packets from 2 (RX) forwarded to port 1 (TX) (this mode is used when repeater is connected to a mirrored traffic). The last one enables both direction repeating (used when probe inserted in a line).
phyterctl(1) is a tool used to display and change configuration of 2 interfaces available on COMBO-2XFP2 cards. The tool displays information about link status, resolved speed or duplex mode on link. phyterctl(1) is also able to change the advertised speed and duplex mode and provides r/w access to internal registers of the physical layer IC.
ibufctl(1) is used to display and change configuration of IBUF components in Flexible FlowMon COMBO6X designs.
$phyterctl -s100 -i0 ... advertise 100 Mbps on interface 0$ibufctl -s100 -i0 ... set 100 Mbps input on interface 0
Example of phyterctl(1) listing with GBIC EEPROM information:
$ phyterctl -c gbic
Settings for card 0 (device /dev/combosix/0):
------------------------------ Interface 0 ---
Phyter status Disconnected
------------------------------ Interface 1 ---
Phyter vendor VITESSE
Phyter model VSC8486 10GbE PHY (rev 3)
Speed 10 Gb/s
Receive signal Detected
TX status Enabled
TX/RX Fault 0/0
Link status Up
------------------------------ Interface 2 ---
Phyter vendor VITESSE
Phyter model VSC8486 10GbE PHY (rev 3)
Speed 10 Gb/s
Receive signal Loss
TX status Enabled
TX/RX Fault 0/0
Link status Down
Note
More information can be found in the phyterctl(1) and ibufctl(1) man pages.
Table of Contents
There are several implementations of NetFlow v5, NetFlow v9 and IPFIX collectors. Some of them handles NetFlow datagrams in a different manner. We recommend using NfSen - Netflow Sensor collector. The IPFIX export format has been tested against the libipfix collector.
NfSen is a graphical web-based front-end for nfdump NetFlow tools. We recommend to use Flexible FlowMon Probe with this collector.
NfSen allows you to:
Display your NetFlow data: Flows, Packets and Bytes using RRD (Round Robin Database).
Easily navigate through the NetFlow data.
Process the NetFlow data within the specified time span.
Create history as well as continuous profiles.
Set alerts based on various conditions.
Write your own plugins to process NetFlow data on a regular interval.
Different tasks need different interfaces to your NetFlow data. NfSen allows you to keep all the convenient advantages of the command line using nfdump directly and gives you also a graphical overview over your NetFlow data.
NfSen is available at http://nfsen.sourceforge.net.
Example of displaying stored NetFlow data by nfdump tool:
$ nfdump -r nfcapd.200705141320 -c 10 ... listing first ten records
Date flow start Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes Flows
2007-05-14 13:08:39.885 4.794 TCP 172.43.198.55:6994 -> 172.43.63.224:1854 18 10337 1
2007-05-14 13:08:44.774 0.000 TCP 57.137.41.68:3039 -> 172.43.63.46:443 1 44 1
2007-05-14 13:08:44.775 0.000 TCP 172.43.63.222:16422 -> 217.190.181.203:60099 1 40 1
2007-05-14 13:08:44.708 0.123 TCP 172.43.198.55:443 -> 172.43.58.194:3341 37 48536 1
2007-05-14 13:08:33.147 31.686 TCP 172.43.60.219:1619 -> 172.43.206.51:445 4657 391386 1
2007-05-14 13:08:33.148 31.686 TCP 172.43.206.51:445 -> 172.43.60.219:1619 6234 7.3 M 1
2007-05-14 13:08:44.707 0.127 TCP 172.43.58.194:3341 -> 172.43.198.55:443 23 1980 1
2007-05-14 13:08:44.648 0.189 TCP 172.43.62.186:3075 -> 196.176.237.132:80 3 615 1
2007-05-14 13:08:44.656 0.188 TCP 172.43.63.199:10080 -> 172.43.58.23:1341 3 128 1
2007-05-14 13:08:44.656 0.190 TCP 172.43.58.23:1341 -> 172.43.63.199:10080 5 358 1
Summary: total flows: 10, total bytes: 7.7 M, total packets: 10982, avg bps: 2.0 M, avg pps: 346, avg bpp: 739
Time window: 2007-05-14 13:08:21 - 2007-05-14 13:11:09
Total flows processed: 15015, skipped: 0, Bytes read: 840852
Sys: 0.004s flows/second: 3004201.7 Wall: 0.005s flows/second: 2869291.0
The libipfix C library implements the IPFIX protocol defined by the IP Flow Information Export working group of the IETF. The library provides functions to collect IPFIX measurement and account data via IPFIX protocol.
The libipfix library is available at http://ants.fokus.fraunhofer.de/libipfix/.
Features:
Collects data in IPFIX format (draft-ietf-ipfix-protocol-24.txt) and NetFlow version 9 format.
IPv4 and IPv6 support.
UDP, TCP and SCTP transport protocol.
Storing data to files or MySQL database.
Table of Contents
For any questions or general technical support issues, please send mail to the netflow [at] liberouter.org general mailing list.
Suggestions, bug reports and contributions of code are always valued. Please do not hesitate to report any problems you find. If you encounter any suspicious behavior of your Flexible FlowMon Probe (it stops monitoring, reports non-existing flows, runs too slow, reports only a few flows, ... ) please contact us.
Please send the following information to us:
Description of the incorrect behavior, including operating system type, kernel version and anything else that causes the bug to appear.
The exact and complete text of all error messages printed or logged.
Exactly what you typed or did to demonstrate the problem.
A suggested fix, or even a patch, if you have one.
This will help us track the problem and resolve it. Bug reports with attached fixes are of course even more welcome.
Check our web pages for information about other projects, such as NIFIC (network interface card with packet filtering and forwarding) or Intrusion Detection System.
We would like to acknowledge and thank to developers who contributed to the Flexible FlowMon Probe project. The list of Flexible FlowMon developers in alphabetical order follows:
- Configuration tools
- Leader of the Software group
- Configuration tools
- Flexible FlowMon exporters
- Firmware design
- Startup scripts
- Firmware design
- Testing
- Testing
- Drivers
- Firmware design
- Configuration tools
- Testing
- Phyter controlling tools
- Firmware design
Table of Contents
[FF techrep 07] Copyright © 2007. Cesnet. Flexible FlowMon, http://www.cesnet.cz/doc/techzpravy/2007/flexible-flowmon/ .
[RFC 3954] Copyright © 2004. Cisco Systems NetFlow Services Export Version 9, http://www.faqs.org/rfcs/rfc3954.html .
[RFC 3917] Copyright © 2004. IETF. Requirements for IP Flow Information Export (IPFIX), http://www.faqs.org/rfcs/rfc3917.html .
[Es03] Copyright © 2003. ACM Trans. Comput. Syst.. New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice.
[CoHW] Description of COMBO cards, http://www.liberouter.org/hardware.php .