<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif"">Hi, I’m working on a research project requires Netflow data. I’ve got a small problem, all of our network equipment will do Netflow, but only to two destinations, and both of
them are being used right now, so I can’t get the data. I’d like to “split the stream” and get that Netflow to more servers… here’s what I have in mind:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif"">Allow all the devices to continue to send feed #1 to the “authorized corporate Netflow analyzer”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif"">Stand up a new server, and send feed #2 from all the devices to the new server that receives all inbound flows, store a copy locally (for integrity) and then redirect the flows
outbound to multiple analyzers (managed services providers, R&D folks etc…) <o:p>
</o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif"">______<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif"">I thought that I’d use NFDUMP/NFCAPD to do it, but I seem to be having problems pulling this off. It could be operator error, but if it is, I cannot see where I am going wrong.
Both nfdump & nfcapd are installed, and they run, but nfcapd does not seem to be collecting anything.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif"">I was trying to originally run it with the following flags:<o:p></o:p></span></p>
<p class="MsoPlainText" style="text-indent:.5in"><span style="font-size:10.0pt;
font-family:"Cambria","serif"">nfcapd -D -p 9996 -l /var/local/nfdump/flows -R 10.17.142.56/9996<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif"">I tried using nfdump and nfreplay to see the contents of the stored flow files and they all appear to be empty except for headers.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Cambria","serif"">At the suggestion of the nfdump mailing list I tried running this:<o:p></o:p></span></p>
<p class="MsoPlainText" style="text-indent:.5in"><span style="font-size:10.0pt;
font-family:"Cambria","serif"">nfcapd -E -l /var/local/nfdump/flows -p 9996<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif"">This is supposed to give me stdout for the flow data but it just sits there and I see nothing… which I believe means that it is not seeing any flow data.<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif"">I do however have 12 routers currently pointing to this server, all on port 9996 so it should be seeing something. When I run “tcpdump port 9996” I see a lot of the following:<br>
<br>
<o:p></o:p></span></p>
<p class="MsoPlainText" style="text-indent:.5in"><span style="font-size:10.0pt;
font-family:"Cambria","serif"">09:06:33.163439 IP 10.17.29.22.64629 > 10.17.142.42.palace-5: UDP, length 696<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif"">So I know that the routers are sending stuff, but apparently nfcapd is not seeing it. Is anybody else doing this sort of thing? If so, how are you doing it? If these ARE
the right tools to use, does anybody have a clue as to where I’m going wrong?<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif"">All help greatly appreciated.<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:10.0pt;font-family:"Cambria","serif""><o:p> </o:p></span></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="2">This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the
sender.<br>
Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of viruses. ITT accepts no
liability for any damage caused by any virus transmitted by this e-mail.<br>
</font>
</body>
</html>