NETFLOW
U
SER
G
UIDE
294
the output must contain:
fprobe: Version 1.0.0 - Tue Nov 6 09:51:59 CET 2012
in case the line above isn't show, it has to be executed:
shell tspkg on fprobe
Installing ’fprobe’ package... ... ...done
’fprobe’ pack
age activated.
The options available to configure the service are:
root@IMOLA>
set netflow
active-flow-lifetime
interface
no-filter
no-memory-limit
on
collector
log-level
no-fragmented-flow-lifetime no-pending-queue-length
pending-queue-length
filter
memory-bulk-size
no-idle-flow-lifetime
no-scan-expired-flow-frequency scan-expired-flow-frequency
fragmented-flow-lifetime
memory-limit
no-log-level
no-source
source
idle-flow-lifetime
no-active-flow-lifetime no-memory-bulk-size
off version
Parameters
The parameters to be configured are:
the input interface of which we want to capture the traffic
set netflow interface <IfName>
IP and collector Port (server analyzing flows)
set netflow collector <IP Collector> [port] <Port>
<Port>
is optional; if omit, default value is 2055
Netflow version (defines the flow characterization)
set netflow version (1|5|7)
the filter to be used
set netflow filter <filter-description>
<filter-description>
is a string that follow the
tcpdump
syntax
the service startup
set netflow on
17
By default, NetFlow capture all incoming packets on the declared interface, but you can use the
filters to decide which IP packets to analyze. IP filtering follows the syntax of the TCPdump tool.
Other configuration parameters are:
log level setting
set netflow log-levl (0|1|2|3|4|5|6|7)
log deactivation
set netflow no-log-levl
setting and deactivation source address (IP of presentation)
set netflow source <ADDRESS>
set netflow no-source
17
-
In order for the service Netflow is enabled after restarting the router you need to enter the activation command in the autoc md set autocmd set netflow on
