NetFlow probe – a real-world example

pexels-pixabay-220769

Usually, our customers configure NetFlow export directly on their devices (routers, switches, firewalls, etc). But in case the company policy (especially in Asian countries) prevents enabling export on devices, or if devices are not capable of exporting NetFlow data, we need to implement a NetFlow probe. There are paid probe software options available, however, we will focus on an open-source NetFlow probe called softflowd. To learn more about softflowd visit their github page: GitHub softflowd. Also, note that the package is available in almost all Linux distributions. 

Architecture 

Since this is a real-world example, every part of the architecture is a physical device:

  • NetVizura NetFlow Analyzer, our NetFlow collector and visualizer, is on Raspberry Pi 4 (check out our blog to learn more about how to configure NetVizura on Raspberry Pi 4)
  • Two physical machines, OpenMediaVault NAS and Proxmox Hypervisor, that are producing traffic and are useful for NetFlow metric
  • MikroTik switch, RB260GS, a simple switch that allows port mirroring, a must-have in our case.

To have a better idea of the architecture described above, take a look at the following visual representation:

Configuration

At the beginning, we are going to configure MikroTik switch:

We have set port mirroring for port 1/Internet to port 5 in both ingress and egress. Since this is a SwOS software, configurations are somewhat simple, and, in our case, this is everything we need to set here. 

Next, we need to install and configure softflowd. To do so, we have added a network card in Proxmox to collect the traffic and send NetFlow packets to NetVizura. As Proxmox is a Debian-based appliance, we can install softflowd with apt install softflowd –y. If you need a newer version than in repos, you can always get it online, and then install it with dpkg –I *.deb file. For the configuration of softflowd we need to edit /etc/softflowd/default.conf file. Let's use an example:

 As with any complex software, there are numerous options and flags, so we will not go deeper into softflowd configuration, since here we have done sufficient to get data flowing.

Testing

Once the configuration is completed, we need to see if there is any traffic coming to NetVizura. Previously, if you want to debug softflowd, two commands output information information about it:


Now, we can go to the NetVizura NetFlow Analyzer, and check whether the traffic is present. As you can see in the screenshot above, everything going through the Internet port is being collected. The Ubuntu container is getting updates from Cannonical, OpenMediaVault serving files via Samba, ssh copying files, etc.

NetVizura Ubuntu upgrade
NetVizura on Raspberry Pi 4

Related Posts

By accepting you will be accessing a service provided by a third-party external to https://www.netvizura.com/

Contact

Mailing and Visiting Address:
Soneco d.o.o.
Makenzijeva 24/VI, 11000 Belgrade, Serbia
Phone: +381.11.6356319
Fax: +381.11.2455210
sales@netvizura.com | support@netvizura.com

CONNECT WITH US:

linkedin facebook facebook