| 1 | Brief instructions for setting up flow-fanout |
|---|
| 2 | --------------------------------------------- |
|---|
| 3 | |
|---|
| 4 | # apt-get install flow-tools |
|---|
| 5 | |
|---|
| 6 | Add something like this to /etc/rc.local: here we assume the original source |
|---|
| 7 | is 10.10.0.254 and the local machine is 10.10.0.250. We will resend the |
|---|
| 8 | packets to 10.10.0.1-26 and to localhost. |
|---|
| 9 | |
|---|
| 10 | flow-fanout 10.10.0.250/10.10.0.254/2002 \ |
|---|
| 11 | 10.10.0.250/10.10.0.1/2002 \ |
|---|
| 12 | 10.10.0.250/10.10.0.2/2002 \ |
|---|
| 13 | 10.10.0.250/10.10.0.3/2002 \ |
|---|
| 14 | 10.10.0.250/10.10.0.4/2002 \ |
|---|
| 15 | 10.10.0.250/10.10.0.5/2002 \ |
|---|
| 16 | 10.10.0.250/10.10.0.6/2002 \ |
|---|
| 17 | 10.10.0.250/10.10.0.7/2002 \ |
|---|
| 18 | 10.10.0.250/10.10.0.8/2002 \ |
|---|
| 19 | 10.10.0.250/10.10.0.9/2002 \ |
|---|
| 20 | 10.10.0.250/10.10.0.10/2002 \ |
|---|
| 21 | 10.10.0.250/10.10.0.11/2002 \ |
|---|
| 22 | 10.10.0.250/10.10.0.12/2002 \ |
|---|
| 23 | 10.10.0.250/10.10.0.13/2002 \ |
|---|
| 24 | 10.10.0.250/10.10.0.14/2002 \ |
|---|
| 25 | 10.10.0.250/10.10.0.15/2002 \ |
|---|
| 26 | 10.10.0.250/10.10.0.16/2002 \ |
|---|
| 27 | 10.10.0.250/10.10.0.17/2002 \ |
|---|
| 28 | 10.10.0.250/10.10.0.18/2002 \ |
|---|
| 29 | 10.10.0.250/10.10.0.19/2002 \ |
|---|
| 30 | 10.10.0.250/10.10.0.20/2002 \ |
|---|
| 31 | 10.10.0.250/10.10.0.21/2002 \ |
|---|
| 32 | 10.10.0.250/10.10.0.22/2002 \ |
|---|
| 33 | 10.10.0.250/10.10.0.23/2002 \ |
|---|
| 34 | 10.10.0.250/10.10.0.24/2002 \ |
|---|
| 35 | 10.10.0.250/10.10.0.25/2002 \ |
|---|
| 36 | 10.10.0.250/10.10.0.26/2002 \ |
|---|
| 37 | 0/0/2002 |
|---|
| 38 | |
|---|
| 39 | If you are also running nfcapd (for nfsen) on the local box, you need to |
|---|
| 40 | change it to bind to localhost, by adding '-b 127.0.0.1' to the command |
|---|
| 41 | line. |
|---|
| 42 | |
|---|
| 43 | The way nfsen starts nfcapd is stupid and non-extensible, but you can frig |
|---|
| 44 | it by editing /var/nfsen/etc/nfsen.conf and setting: |
|---|
| 45 | |
|---|
| 46 | $BUFFLEN = "2000 -b 127.0.0.1"; |
|---|
| 47 | |
|---|