@@ -5,13 +5,13 @@ Version 9 is the first NetFlow version using templates.
5
5
Templates make dynamically sized and configured NetFlow data flowsets possible,
6
6
which makes the collector's job harder.
7
7
8
- Copyright 2016-
2019 Dominik Pataky
< [email protected] >
8
+ Copyright 2016-
2020 Dominik Pataky
< [email protected] >
9
9
10
10
Licensed under MIT License. See LICENSE.
11
11
12
12
13
13
## Using the collector and analyzer
14
- In this repo you also find ` main.py ` and ` analyze_json .py` .
14
+ In this repo you also find ` main.py ` and ` analyzer .py` .
15
15
16
16
To start an example collector run ` python3 main.py -p 9000 -D ` . This will run
17
17
a collector at port 9000 in debug mode. Point your flow exporter to this port on
@@ -21,8 +21,9 @@ need to expire first).
21
21
After you collected some data, ` main.py ` exports them into GZIP files, simply
22
22
named ` <timestamp>.gz ` .
23
23
24
- To analyze the saved traffic, run ` analyze_json.py -f <gzip file> ` . In my example
25
- script this will look like the following, with resolved hostnames and services, transfered bytes and connection duration:
24
+ To analyze the saved traffic, run ` analyzer.py -f <gzip file> ` . In my example
25
+ script this will look like the following, with resolved hostnames and services,
26
+ transfered bytes and connection duration:
26
27
27
28
2017-10-28 23:17.01: SSH | 4.25M | 15:27 min | localmachine-2 (<IPv4>) to localmachine-1 (<IPv4>)
28
29
2017-10-28 23:17.01: SSH | 4.29M | 16:22 min | remotemachine (<IPv4>) to localmachine-2 (<IPv4>)
@@ -31,8 +32,10 @@ script this will look like the following, with resolved hostnames and services,
31
32
2017-10-28 23:23.01: SSH | 93.79M | 21 sec | remotemachine (<IPv4>) to localmachine-2 (<IPv4>)
32
33
2017-10-28 23:51.01: SSH | 14.08M | 1:23.09 hours | remotemachine (<IPv4>) to localmachine-2 (<IPv4>)
33
34
34
- Feel free to customize the analyzing script, e.g. make it print some
35
- nice graphs or calculate broader statistics.
35
+ Feel free to customize the analyzing script, e.g. make it print some nice graphs or calculate broader statistics.
36
+
37
+ ** Please note that the analyzer is experimental and has some rough edges. Do not rely on it in monitoring use cases!**
38
+
36
39
37
40
## Resources
38
41
* [ Cisco NetFlow v9 paper] ( http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html )
@@ -43,7 +46,7 @@ I have specifically written this script in combination with NetFlow exports from
43
46
[ softflowd] ( https://github.com/djmdjm/softflowd ) v0.9.9 - it should work with every
44
47
correct NetFlow v9 implementation though.
45
48
46
- ### Running tests
49
+ ### Running and creating tests
47
50
The file ` tests.py ` contains some tests based on real softflowd export packets.
48
51
To create the test packets try the following:
49
52
0 commit comments