Diferencia entre revisiones de «Flowscan»
De gacq wiki
(→Reiniciar servicios) |
|||
| Línea 83: | Línea 83: | ||
</nowiki></pre> | </nowiki></pre> | ||
| − | ====/etc/ | + | ====/etc/default/fprobe==== |
<pre><nowiki> | <pre><nowiki> | ||
INTERFACE="eth0" | INTERFACE="eth0" | ||
| Línea 96: | Línea 96: | ||
chown root.root /etc/init.d/flowscan | chown root.root /etc/init.d/flowscan | ||
ln -s /etc/init.d/flowscan /etc/rc2.d/S98flowscan | ln -s /etc/init.d/flowscan /etc/rc2.d/S98flowscan | ||
| + | adduser flowscan | ||
</nowiki></pre> | </nowiki></pre> | ||
| + | ====/etc/init.d/flowscan==== | ||
| + | Change lines: | ||
| + | bindir=/usr/bin | ||
| + | scandir=/var/lib/netflow/ft | ||
| + | logfile=/tmp/flowscan.log | ||
| + | user=flowscan | ||
====Reiniciar servicios==== | ====Reiniciar servicios==== | ||
Revisión actual del 19:35 27 ago 2007
Contenido
Informacion
- http://net.doit.wisc.edu/~plonka/lisa/FlowScan/
- http://www.switch.ch/tf-tant/floma/software.html
- http://www.caida.org/tools/utilities/flowscan/
Reportes de ejemplo
Analisis del trafico por una interface ethernet en un servidor debian
Fuente: http://www.prolixium.com/sitenews.php?id=482
apt-get install fprobe-ng flow-tools flowscan flowscan-cuflow flowscan-cugrapher rrdtool mkdir -p /var/lib/netflow/ft mkdir /var/lib/netflow/rrds mkdir /var/lib/netflow/scoreboard
/etc/flow-tools/flow-capture.conf
-w /var/lib/netflow/ft -E 1G -N 0 -n 287 -S 60 -V 5 -z 9 0/0/555
/etc/flowscan/flowscan.cf
FlowFileGlob /var/lib/netflow/ft/ft-v05.* ReportClasses CUFlow WaitSeconds 30 Verbose 1
/etc/flowscan/CUFlow.cf
Subnet 192.168.0.0/24 Network 200.114.249.74/24 Internet OutputDir /var/lib/netflow/rrds Multicast Scoreboard 10 /var/lib/netflow/scoreboard /var/lib/netflow/topten.html AggregateScore 10 /var/lib/netflow/scoreboard/agg.dat /var/lib/netflow/scoreboard/overall.html Router 127.0.0.1 geacequ Service 20-21/tcp ftp Service 22/tcp ssh Service 23/tcp telnet Service 25/tcp smtp Service 53/udp,53/tcp dns Service 80/tcp http Service 110/tcp pop3 Service 119/tcp nntp Service 143/tcp imap Service 412/tcp,412/udp dc Service 443/tcp https Service 1214/tcp kazaa Service 4661-4662/tcp,4665/udp edonkey Service 5190/tcp aim Service 6346-6347/tcp gnutella Service 6665-6669/tcp irc Service 54320/tcp bo2k Service 7070/tcp,554/tcp,6970-7170/udp real Protocol 1 icmp Protocol 4 ipinip Protocol 6 tcp Protocol 17 udp Protocol 47 gre Protocol 50 esp Protocol 51 ah Protocol 57 skip Protocol 88 eigrp Protocol 169 Protocol 255 TOS 0 normal TOS 1-255 other ASNumber 1 Genuity
Se puede ver la sintaxis aca: http://www.columbia.edu/acis/networks/advanced/CUFlow/CUFlow.html
/etc/flowscan/CUGrapher.cf
OutputDir /var/lib/netflow/rrds DefaultGraph report=bits;hours=48;imageType=png;width=640;height=320;duration=;router=all;all_all_services=1;legend=1;title=My%20Graph AggregateScore /var/lib/netflow/scoreboard/overall.html Scoreboard /var/lib/netflow/topten.html
/etc/default/fprobe
INTERFACE="eth0" FLOW_COLLECTOR="localhost:555" OTHER_ARGS="-p -a 127.0.0.1"
Configurar para el el flowscan inicie automaticamente
zcat /usr/share/doc/flowscan/examples/rc/flowscan.gz > /etc/init.d/flowscan chmod 755 /etc/init.d/flowscan chown root.root /etc/init.d/flowscan ln -s /etc/init.d/flowscan /etc/rc2.d/S98flowscan adduser flowscan
/etc/init.d/flowscan
Change lines:
bindir=/usr/bin scandir=/var/lib/netflow/ft logfile=/tmp/flowscan.log user=flowscan
Reiniciar servicios
/etc/init.d/flow-capture restart /etc/init.d/fprobe restart /etc/init.d/flowscan start
Abrir: http://localhost/cgi-bin/CUGrapher.cgi
Errores
Errores al correr flowscan
2006/07/26 18:12:22 working on file /var/lib/netflow/ft/ft-v05.2006-07-26.174716-0300... /var/lib/netflow/ft/ft-v05.2006-07-26.174716-0300: Invalid index in cflowd flow file: 0xCF100103! Version 5 flow-export is required with *all* fields being saved.
Pasa con la version 0.67-8 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=327367
