network_stuff:flow_information
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| network_stuff:flow_information [2023/05/11 12:34] – jotasandoku | network_stuff:flow_information [2023/11/02 14:38] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 27: | Line 27: | ||
| ip flow monitor Flow-monitor sampler Flow-sampler input | ip flow monitor Flow-monitor sampler Flow-sampler input | ||
| - | Netflow in ubuntu or FRR: | + | Netflow in ubuntu or FRR (agent): |
| \\ | \\ | ||
| FRR01:~# systemctl status pmacctd.service | FRR01:~# systemctl status pmacctd.service | ||
| Line 58: | Line 58: | ||
| pre_tag_map: | pre_tag_map: | ||
| timestamps_secs: | timestamps_secs: | ||
| - | | + | |
| + | SFLOW collector: | ||
| + | * The default open source collector is : [[http:// | ||
| ---- | ---- | ||
| **__SFLOW__** | **__SFLOW__** | ||
| + | * sampled frames + interface counter + flow-tuple data. All in the same packet | ||
| + | * sflow is configurable via SNMP mibs | ||
| + | |||
| + | * Flow sample (conceptually one in each sflow packet but in reality we pack more than 1). It lists things like: ingress egress. ifindex and < | ||
| + | * Flow record (the frame header with a little bit of metadata (like header protocol (eg: Ethernet)) | ||
| + | |||
| + | |||
| \\ | \\ | ||
| - | IN LINUX / FRR: | + | SFLOW IN LINUX / FRR: |
| \\ | \\ | ||
| USE 'HOST SFLOW' PROJECT: [[https:// | USE 'HOST SFLOW' PROJECT: [[https:// | ||
| + | |||
| + | # Example of working config in / | ||
| + | sflow { | ||
| + | polling = 20 | ||
| + | sampling = 100 | ||
| + | collector { ip=10.100.11.143 udpport=6343 } | ||
| + | pcap { dev = ens4 } | ||
| + | nflog { group = 5 probability = 0.01 } | ||
| + | } | ||
| + | | ||
| + | # Then we need to issue this commandsL: | ||
| + | NFLOG_CONFIG=" | ||
| + | echo 1 > / | ||
| + | MOD_STATISTIC=" | ||
| + | NFLOG_CONFIG=" | ||
| + | sudo iptables -I INPUT -j NFLOG $MOD_STATISTIC $NFLOG_CONFIG | ||
| + | sudo iptables -I OUTPUT -j NFLOG $MOD_STATISTIC $NFLOG_CONFIG | ||
| + | | ||
| + | # Ad restart: | ||
| + | sudo systemctl enable hsflowd | ||
| + | service hsflowd start | ||
| + | | ||
| + | # If issues | ||
| + | service hsflowd start | ||
| + | hsflowd -dd | ||
| + | |||
| + | Also see: | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| + | * [[https:// | ||
| \\ | \\ | ||
| \\ | \\ | ||
| In Arista: | In Arista: | ||
| + | * Arista Networks DCS-7060CX-32S: | ||
| + | |||
| + | sflow run | ||
| + | sflow interface disable default | ||
| int e2 | int e2 | ||
| ip address 10.100.11.129/ | ip address 10.100.11.129/ | ||
| Line 79: | Line 123: | ||
| sflow destination 10.100.11.143 6343 | sflow destination 10.100.11.143 6343 | ||
| sflow source 10.100.11.129 | sflow source 10.100.11.129 | ||
| + | sflow source-interface e3 | ||
| sflow polling-interval 30 # interval for sending counter data to the sFlow collector. The default interval is two seconds. | sflow polling-interval 30 # interval for sending counter data to the sFlow collector. The default interval is two seconds. | ||
| sflow sample 15 # packet sampling rate. Packets are sampled at random intervals to avoid inaccurate sampling of periodic events. | sflow sample 15 # packet sampling rate. Packets are sampled at random intervals to avoid inaccurate sampling of periodic events. | ||
| sflow extension bgp # Optional. routing agent will export the BGP routing table and autonomous system path information to the sFlow agent | sflow extension bgp # Optional. routing agent will export the BGP routing table and autonomous system path information to the sFlow agent | ||
| + | ! | ||
| + | show sflow detail | ||
| + | | ||
| + | In Junos | ||
| + | set protocols sflow polling-interval 2 # interval for sending data to the collector | ||
| + | set protocols sflow sample-rate ingress 4096 # packet sampling rate. Packets are sampled at random intervals | ||
| + | set protocols sflow source-ip 1.1.1.1 | ||
| + | set protocols sflow collector 2.2.2.2 udp-port 6343 | ||
| + | set protocols sflow interfaces xe-0/ | ||
| + | ibr-0-0-1 protocols sflow | ||
| + | set protocols sflow agent-id 1.1.1.1 | ||
| + | set protocols sflow polling-interval 1 | ||
| + | set protocols sflow sample-rate ingress 1024 | ||
| + | set protocols sflow source-ip 1.1.1.1 | ||
| + | set protocols sflow collector 2.2.2.2 udp-port 6343 | ||
| + | set protocols sflow interfaces xe-0/ | ||
| + | | ||
| + | In Cisco (IOS-XR): [[https:// | ||
network_stuff/flow_information.1683808443.txt.gz · Last modified: (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
