farrokhi/nfdump
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update Readme

Browse Source
This commit is contained in:
Peter Haag 2017-12-29 16:18:24 +01:00
parent fccabf69ab
commit f999bfe050
1 changed files with 37 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
README.md
View File

@ -4,8 +4,8 @@ Stable Release v1.6.16
See the Changelog file for all changes in release 1.6.16 See the Changelog file for all changes in release 1.6.16
nfdump is a toolset in oder to collect and process netflow data, sent from netflow compatible devices. The toolset supports netflow __v1__, __v5/v7__ __v9__ and __IPFIX__. See the details below for a more details explanation. nfdump is a toolset in oder to collect and process netflow and sflow data, sent from netflow/sflow compatible devices.
The toolset also contains a collector to collect __sflow__ data. nfdump supports IPv4 as well as IPv6. The toolset supports netflow __v1__, __v5/v7__,__v9__,__IPFIX__ and __SFLOW__. nfdump supports IPv4 as well as IPv6.
nfdump is used as backend toolset for __NfSen__. nfdump is used as backend toolset for __NfSen__.
@ -21,12 +21,11 @@ __Note:__ The older nfdump-1.5.8-2-NSEL is __not compatible__ with nfdump > 1.6.
## IPFIX ## IPFIX
nfdump contains an IPFIX module for decoding IPFIX data. It nfdump contains an IPFIX module for decoding IPFIX flow data. It
is does not support the full IPFIX definition, however is considered stable. does not support the full IPFIX definition.
* Supports basically same feature set of elements as netflow_v9 module * Supports basically same feature set of elements as netflow_v9 module
* Only UDP traffic is accepted no SCTP so far * Only UDP traffic is accepted no tCP/SCTP
* No sampling support.
* If you would like to see more IPFIX support, please contact me. * If you would like to see more IPFIX support, please contact me.
--- ---
@ -36,9 +35,8 @@ is does not support the full IPFIX definition, however is considered stable.
### Building and config options ### Building and config options
The toolset is build upon the autotools framework, which means __./configure ./make__ and __./make install__ should do the trick The toolset is build upon the autotools framework. Run __./autogen.sh__ first.
In case of an autoconf error, run 'autoreconf -if' first to sync with your Afterwards __./configure ./make__ and __./make install__ should do the trick.
local version of autotools
The following config options are available: The following config options are available:
@ -73,9 +71,9 @@ every 5 min ) The netflow versions mentioned above are read transparently
Multiple netflow streams can be collected by a single or collector. Multiple netflow streams can be collected by a single or collector.
nfcapd can listen on IPv6 or IPv4. Furthermore multicast is supported. nfcapd can listen on IPv6 or IPv4. Furthermore multicast is supported.
__nfdump__ - process collected netflow records. __nfdump__ - process collected netflow records.
Nfdump reads the netflow data from one or many files stored by nfcapd. It's filter syntax is similar to tcpdump ( pcap like ) but adapted for netflow. Nfdump reads the netflow data from one or many files stored by nfcapd.
It's filter syntax is similar to tcpdump ( pcap like ) but adapted for netflow.
If you like tcpdump you will like nfdump. nfdump displays netflow If you like tcpdump you will like nfdump. nfdump displays netflow
data and/or creates top N statistics of flows, bytes, packets. nfdump data and/or creates top N statistics of flows, bytes, packets. nfdump
has a powerful and flexible flow aggregation including bi-directional has a powerful and flexible flow aggregation including bi-directional
@ -96,7 +94,7 @@ over the network to another host.
__sfcapd__ - sflow collector daemon __sfcapd__ - sflow collector daemon
scfapd collects sflow data and stores it into nfcapd comaptible files. scfapd collects sflow data and stores it into nfcapd comaptible files.
"sfcapd includes sFlow(TM) code, freely available from http://www.inmon.com/". "sfcapd includes sFlow(TM) code, freely available from https://github.com/sflow/sflowtool.
__nfprofile__ - netflow profiler. Required by NfSen __nfprofile__ - netflow profiler. Required by NfSen
Reads the netflow data from the files stored by nfcapd. Filters the Reads the netflow data from the files stored by nfcapd. Filters the
@ -120,16 +118,29 @@ for any other purpose.
####Notes for sflow users: ####Notes for sflow users:
sfcapd and nfcapd can be used concurrently to collect netflow and sflow sfcapd and nfcapd can be used concurrently to collect netflow and sflow
data at the same time. Generic command line options apply to both data at the same time. Generic command line options apply to both
collectors likewise. sfcapd's sflow decoding module is based on InMon's sflowtool code and supports similar fields as nfcapd does for netflow v9, which is a subset of all available sflow fields in an sflow record. More fields may be integrated in future versions of sfcapd. collectors likewise. sfcapd's sflow decoding module is based on InMon's
sflowtool code and supports similar fields as nfcapd does for netflow v9,
which is a subset of all available sflow fields in an sflow record.
More fields may be integrated in future versions of sfcapd.
--- ---
###Compression ###Compression
Binary data files can optionally be compressed using either the fast LZO1X-1 compression, or the efficient bzip2 methode. Binary data files can optionally be compressed using either the fast LZO1X-1 compression,
If you compress automatically flows while they are collected, only the LZO1X-1 methode is recommended. bzip uses about 30 times more CPU than LZ4 or the efficient but slow bzip2 methode.
LZO1X-1. Used bzip2 to archive data, which may reduce the disk usage again by a factor of 2. The compression of flow files can be changed any time later with nfdump. If you compress automatically flows while they are collected, LZO1X-1 or LZ4 methodes are
For more details on LZO1X-1 see, http://www.oberhumer.com/opensource/lzo. recommended. bzip2 uses about 30 times more CPU than LZO1X-1. Use bzip2 to archive netflow
You can check the compression speed for your system by doing ./nftest <path/to/an/existing/netflow/file>. data, which may reduce the disk usage again by a factor of 2. The compression of flow files
can be changed any time with nfdump -J <num>
For more details on each methde, see:
LZO1X-1: http://www.oberhumer.com/opensource/lzo
LZ4: https://github.com/lz4/lz4
bzip2: http://www.bzip.org
You can check the compression speed for your system by running ./nftest <path/to/an/existing/netflow/file>.
--- ---
@ -377,7 +388,14 @@ which may or may not be stored into the data file. Therefore the v9 templates co
###Sampling ###Sampling
By default, the sampling rate is set to 1 (unsampled) or to By default, the sampling rate is set to 1 (unsampled) or to
any given value specified by the -s cmd line option. If sampling information is found in the netflow stream, it overwrites the default value. Sampling is automatically recognised when announced in v9 option templates (tags #48, #49, #50 ) or in the unofficial v5 header hack. Note: Not all platforms (or IOS versions) support exporting sampling information in netflow data, even if sampling is configured. The number of bytes/packets in each netflow record is automatically multiplied by the sampling rate. The total number of flows is not changed as this is not accurate enough. (Small flows versus large flows) any given value specified by the -s cmd line option. If sampling information is found
in the netflow stream, it overwrites the default value. Sampling is automatically
recognised when announced in v9 option templates (tags #48, #49, #50 ), (tag #34, #35)
or in the unofficial v5 header hack.
Note: Not all platforms (or IOS versions) support exporting sampling information in
netflow data, even if sampling is configured. The number of bytes/packets in each
netflow record is automatically multiplied by the sampling rate. The total number of
flows is not changed as this is not accurate enough. (Small flows versus large flows)
--- ---