Skip to content

Commit ce2be70

Browse files
committed
Update README + LICENSE
1 parent 8de1109 commit ce2be70

File tree

2 files changed

+17
-15
lines changed

2 files changed

+17
-15
lines changed

LICENSE

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
MIT License
22

3-
Copyright (c) 2016, 2017 Dominik Pataky <[email protected]>
3+
Copyright (c) 2016-2019 Dominik Pataky <[email protected]>
44

55
Permission is hereby granted, free of charge, to any person obtaining a copy
66
of this software and associated documentation files (the "Software"), to deal

README.md

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,10 @@ Version 9 is the first NetFlow version using templates.
55
Templates make dynamically sized and configured NetFlow data flowsets possible,
66
which makes the collector's job harder.
77

8-
Copyright 2017-2019 Dominik Pataky <[email protected]>
9-
Licensed under MIT License. See LICENSE.
10-
11-
## Running tests
12-
The file `tests.py` contains some tests based on real softflowd export packets.
13-
To create the test packets try the following:
8+
Copyright 2016-2019 Dominik Pataky <[email protected]>
149

15-
1. Run tcpdump/Wireshark on your interface
16-
2. Produce some sample flows, e.g. surf the web and refresh your mail client.
17-
3. Save the pcap file to disk.
18-
4. Run tcpdump/Wireshark again on an interface.
19-
4. Run softflowd with the `-r <pcap_file>` flag. softflowd reads the captured traffic, produces the flows and exports them. Use the interface you are capturing packets on to send the exports.
20-
5. Examine the captured traffic. Use Wireshark and set the `CFLOW` "decode as" dissector on the export packets (e.g. based on the port). The `data` fields should then be shown correctly as Netflow payload.
21-
6. Extract this payload as hex stream. Anonymize the IP addresses with a hex editor if necessary. A recommended hex editor is [bless](https://github.com/afrantzis/bless).
10+
Licensed under MIT License. See LICENSE.
2211

23-
The collector is run in a background thread. The difference in transmission speed from the exporting client can lead to different results, possibly caused by race conditions during the usage of the JSON output file.
2412

2513
## Using the collector and analyzer
2614
In this repo you also find `main.py` and `analyze_json.py`.
@@ -54,3 +42,17 @@ nice graphs or calculate broader statistics.
5442
I have specifically written this script in combination with NetFlow exports from
5543
[softflowd](https://github.com/djmdjm/softflowd) v0.9.9 - it should work with every
5644
correct NetFlow v9 implementation though.
45+
46+
### Running tests
47+
The file `tests.py` contains some tests based on real softflowd export packets.
48+
To create the test packets try the following:
49+
50+
1. Run tcpdump/Wireshark on your interface
51+
2. Produce some sample flows, e.g. surf the web and refresh your mail client.
52+
3. Save the pcap file to disk.
53+
4. Run tcpdump/Wireshark again on an interface.
54+
4. Run softflowd with the `-r <pcap_file>` flag. softflowd reads the captured traffic, produces the flows and exports them. Use the interface you are capturing packets on to send the exports.
55+
5. Examine the captured traffic. Use Wireshark and set the `CFLOW` "decode as" dissector on the export packets (e.g. based on the port). The `data` fields should then be shown correctly as Netflow payload.
56+
6. Extract this payload as hex stream. Anonymize the IP addresses with a hex editor if necessary. A recommended hex editor is [bless](https://github.com/afrantzis/bless).
57+
58+
The collector is run in a background thread. The difference in transmission speed from the exporting client can lead to different results, possibly caused by race conditions during the usage of the JSON output file.

0 commit comments

Comments
 (0)