Netflow analytics

Netflow Analytics

In order to get the netflows for our analyzing we can use the next tools that will help us in this task:

Softflowd allows us to send the netflows according to our network data
Nfdump has the tools to get and process the netflow files that we have gotten from softflowd

Settings

Softflowd

We can modify the softflowd interface through the next file, it is important to define the IP and port.

/etc/default/softflowd

Once the file was changed we can start the demon softflowd

/etc/init.d/softflowd start

Using the next command we can check if we are getting the data and changing them to flows.

softflowd -i interface -n IP:PORT -D

statistics is a command from softlowd who shows some statistics of our flows.

softflowctl statistics

nfdump

sudo systemctl enable nfdump.service

Let's stop the service to change the settings (the port)

sudo pico /lib/systemd/system/nfdump.service

The nfdump's settings file is this

sudo vi /lib/systemd/system/nfdump.service

Reload systemd daemons and start ndfdump:

sudo systemctl daemon-reload
sudo systemctl start nfdump.service

We can be sure if the ports are OK using the netstat

netstat -n --udp --listen

Using the next command we can print the data through nfdump

nfdump -R /var/cache/nfdump

nfdump -r nfcapd.2017xxxxx -o extended -o csv -q

Convert to CSV

nfdump -r file -o csv > output.csv

Filter IP

nfdump -r [input file] 'net 8.8.8.8/32'