Agenda: netflow-nfsen-exercise.txt

File netflow-nfsen-exercise.txt, 2.9 KB (added by oflaherty-guatemala, 9 years ago)
Line 
1Advanced Registry Operations Curriculum
2
3NetFlow - NFSen - Exercise
4
50. If not already installed, install the following packages:
6
7# apt-get install rrdtool
8# apt-get install librrds-perl
9# apt-get install librrdp-perl
10
11
121. Install nfdump
13
14[Nfdump is the netflow flow collector]
15
16
17# export INIT_VERBOSE=yes
18# export VERBOSE=yes
19# apt-get install nfdump
20
21        (the lines with VERBOSE are needed to work around a bug in the
22        package installation script)
23
24---
25Installed tools are :
26nfcapd nfdump nfreplay nfexpire nftest nfgen
27---
28
29
30NFSen
31
321. Now get nfsen
33
34$ wget http://freefr.dl.sourceforge.net/project/nfsen/stable/nfsen-1.3.2/nfsen-1.3.2.tar.gz
35
362. Setting up NfSen
37
38$ tar -xzf nfsen-1.3.2.tar.gz
39$ cd nfsen-1.3.2
40$ cd etc
41# cp nfsen-dist.conf nfsen.conf
42
43Edit the nfsen.conf, and make the following changes:
44
45- set the basedir variable
46
47$BASEDIR = "/var/nfsen";
48
49- set the path for the PREFIX where to find the nfdump tools:
50
51# nfdump tools path
52$PREFIX = '/usr/bin';
53
54- set the users:
55
56$USER = "netflow"
57$WWWUSER = 'www-data';
58$WWWGROUP = 'www-data';
59
60- set the buffer size to something small, so we see data quickly
61
62# Receive buffer size for nfcapd - see man page nfcapd(1)
63$BUFFLEN = 2000;
64
65- find the %sources definition, and change it to:
66
67%sources = (
68        'tldX-rtr'     => { 'port'    => '2002', 'col' => '#ff0000' },
69);
70
71(remember to replace 'X' with the number of your TLD)
72
73- save the file, and exit.
74
753. Create a netflow user on the system.
76
77# useradd -d /var/netflow -G www-data -m -s /bin/false netflow
78
794. Initiating nfsen
80
81# cd ..
82# perl install.pl etc/nfsen.conf
83
84[press 'return' when asked where perl is located ]
85
865. Starting Nfsen
87
88# cd /var/nfsen/bin
89# ./nfsen start
90
91(You can add the nfsen startup script to /etc/init.d/rc.local or somewhere similar to start it at bootup.)
92
93
946. Now we need to configure your router to export NetFlow flows.
95
96Using the slides on NetFlow (slides 36 and following), configure
97the IOS on your TLD router to export flows to your NOC, on port 2002
98(as you configured in point 2.
99
100Once you have done this, it will take some time for data to show up
101in NFsen...
102
103Watch your browser at http://your-IP/nfsen/nfsen.php
104
1057. Add more sources:
106
107Go back to where you extracted your nfsen distribution.
108
109# cd nfsen-1.3.2
110# vi etc/nfsen.conf
111
112%sources = (
113        'tldX-rtr'     => { 'port'    => '2002', 'col' => '#ff0000' },
114        'tldY-rtr'     => { 'port'    => '2003', 'col' => '#ff0000' },
115);
116
117Save & close.
118
119Now, ask your neighbor to add a NetFlow export destination -- by default
120the IOS software supports 2 -- pointing at your NOC, on port 2003.
121
122Once you have double checked with your neighbor that they have configured
123netflow export, check with tcpdump on your NOC that you are seeing packets
124on port 2003:
125
126# tcpdump -n port 2003 and udp
127...
128^C
129
130
131Finally, reconfigure and restart NFSen:
132
133# perl install.pl etc/nfsen.conf
134
135[press return when asked]
136
1378. Start NFsen
138
139# /var/nfsen/bin/nfsen stop
140# /var/nfsen/bin/nfsen start
141
1429. Check it out!
143
144http://your IP/nfsen/nfsen.php
145
146