(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
IPFIX (Netflow V10) is but in the meantime i've been able to get it working thus:
+
 +
IPFIX (Netflow V10) is but in the meantime i've been able to get it working thus:
  
−
[[Nprobe]]
+
[[Nprobe]]
 
I know, nprobe is commercial but i had it lying around so chose to use it.  It can output in a variety of ways but in the base license model only zeromq and tcp methods allow direct output to logstash.  My experience with zeromq was initially good but after a reinstall i couldn't get it working again, something wrong with the encoding or compression or something meant that logstash was seeing the data as garbage.
 
I know, nprobe is commercial but i had it lying around so chose to use it.  It can output in a variety of ways but in the base license model only zeromq and tcp methods allow direct output to logstash.  My experience with zeromq was initially good but after a reinstall i couldn't get it working again, something wrong with the encoding or compression or something meant that logstash was seeing the data as garbage.
  
−
Switching to tcp output in json format got it working in the end so this is the nprobe config file, you'll note that local interface sniffing is disabled it only listens for flows on port 2100:
+
Switching to tcp output in json format got it working in the end so this is the nprobe config file, you'll note that local interface sniffing is disabled it only listens for flows on port 2100:
  
 
<pre>
 
<pre>
Line 21: Line 22:
 
<pre>
 
<pre>
 
touch /etc/nprobe/nprobe-eth0.start
 
touch /etc/nprobe/nprobe-eth0.start
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 
</pre>
 
</pre>

Latest revision as of 21:35, 11 January 2018

Native IPFIX (Netflow V10) for Logstash is still in development but in the meantime i've been able to get it working thus:

Nprobe

I know, nprobe is commercial but i had it lying around so chose to use it. It can output in a variety of ways but in the base license model only zeromq and tcp methods allow direct output to logstash. My experience with zeromq was initially good but after a reinstall i couldn't get it working again, something wrong with the encoding or compression or something meant that logstash was seeing the data as garbage.

Switching to tcp output in json format got it working in the end so this is the nprobe config file, you'll note that local interface sniffing is disabled so it only listens for flows on port 2100:

And the nprobe init files:

Logstash

The logstash config is easy unless you want to filter the flows as they arrive:

I chose to do some filtering to assign nice names and tags to my SNMP interface ids

Kibana

The dashboard and visualisations i built for Kibana suit me nicely and are included here in case you want to use them.

Dashboard

Visualisations