Diferencia entre revisiones de «Análisis de tráfico»
De gacq wiki
| Línea 17: | Línea 17: | ||
*flow-tools is actively maintained, and supports newer NetFlow versions, including those from the popular Cisco Cat6K series platforms | *flow-tools is actively maintained, and supports newer NetFlow versions, including those from the popular Cisco Cat6K series platforms | ||
| − | + | == Analisis del trafico por una interface ethernet en un servidor debian == | |
Fuente: http://www.prolixium.com/sitenews.php?id=482 | Fuente: http://www.prolixium.com/sitenews.php?id=482 | ||
<pre><nowiki> | <pre><nowiki> | ||
| Línea 44: | Línea 44: | ||
</nowiki></pre> | </nowiki></pre> | ||
| − | + | /etc/flowscan/CUFlow.cf | |
| − | + | <pre><nowiki> | |
| + | </nowiki></pre> | ||
Revisión del 18:02 26 jul 2006
Contenido
Analisis de trafico
NetFlow
Informacion
flowscan
http://www.caida.org/tools/utilities/flowscan/ Reportes de ejemplo:
flow-tools vs cflowd
Why use flow-tools instead of cflowd?
- flow-capture preserves the sub-second portion of the NetFlow timestamps that cflowd discards
- flow-tools is easier to build because it is written in portable C. Problems with building cflowd may occur because it requires cutting edge C++ features
- flow-tools is actively maintained, and supports newer NetFlow versions, including those from the popular Cisco Cat6K series platforms
Analisis del trafico por una interface ethernet en un servidor debian
Fuente: http://www.prolixium.com/sitenews.php?id=482
apt-get install fprobe-ng flow-tools flowscan flowscan-cuflow flowscan-cugrapher rrdtool mkdir -p /var/lib/netflow/ft mkdir /var/lib/netflow/rrds mkdir /var/lib/netflow/scoreboard
Dejar /etc/flow-tools/flow-capture.conf solo con:
-w /var/lib/netflow/ft -E 1G -N 0 -n 287 -S 60 -V 5 -z 9 0/0/555
Reiniciar el servicio
/etc/init.d/flow-capture restart
dejar /etc/flowscan/flowscan.cf con
FlowFileGlob /var/lib/netflow/ft/ft-v05.* ReportClasses CUFlow WaitSeconds 30 Verbose 1
/etc/flowscan/CUFlow.cf
