The easiest software to install is the sensor. First, make sure that your
sensor hardware can listen to all network traffic. Once you have that you can
install sensor software. I recommend
Sortflowd runs out-of-the-box with a simple
make all install clean
on BSD and Linux, requiring only libpcap. (FreeBSD includes the
ng_netflow netflow system, but as I have sensors running on Linux
as well, I don't use it. I prefer to use a single piece of software on every
operating system whenever possible.) Once you have softflowd installed, you
only need the interface name you want to monitor and the IP address and UDP
port where your collector is listening. For example, to listen on the
em0 interface and send the collected data to 172.16.13.5, port
# softflowd -i em0 -n 172.16.13.5:8818
The sensor will immediately begin listening to the network and sending session information to the collector. Make sure that this program starts at boot!
Softflowd includes a control program,
allows you to issue commands to a running softflowd. To make sure that the
software is actually working, check the softflow statistics after softflowd has
been running for a few moments.
# softflowctl statistics softflowd: Accumulated statistics: Number of active flows: 2298 Packets processed: 268086 Fragments: 0 Ignored packets: 867 (867 non-IP, 0 too short) Flows expired: 3103 (0 forced) Flows exported: 6206 in 214 packets (0 failures) ...
The important output here is the second line, which tells you how many flows
are active at the moment, and the
exported line, which tells you
how many flows softflowd has exported to the collector.
If you search, you can find a wide variety of sensors. Cisco routers can export Netflow data--at the expense of your router's precious CPU time. If you have a complicated router setup, or if you have a very low-end router, this can overload your router. Cisco would be very happy to sell you a router upgrade so that you could properly export Netflow, mind you, but generally a Unix-like box is more cost-effective. Many other devices also speak Netflow; check your documentation if you're interested.
If you have Ethereal or tcpdump installed, I recommend using it at this
point to confirm that you are actually receiving Netflow data at your
collector. If not, confirm that softflowd is running and perhaps try the
-D (debug) flag to see if there are any problems with your
Softflowd only sends flow information to the collector once the flow has
ended--for example, when the FTP session ends, when the Web page has been
delivered, and so on. This means that at any moment, softflowd will have a
cache of connections in progress. When you stop softflowd, run
softflowctl shutdown so that softflowd will expire those flows and
send them to your collector immediately. Simply shutting down the server
running softflowd will cause you to lose the active-but-incomplete flows.
You're going to lose some information anyway if you reboot your sensor, but you
might as well keep that loss as minimal as possible.