Work at SourceForge, help us to make it a better place! We have an immediate need for a Support Technician in our San Francisco or Denver office.

Close

fprobe-ulog

NST
2012-10-11
2012-12-05
  • Pete hoffswell
    Pete hoffswell
    2012-10-11

    Greetings -

    I see fprobe-ulog is on the newest version of NST.  fprobe-ulog allows you to create netflow records on you NST box for delivery to a netflow collector.  Very handy if you happen to have routers that don't support netflow.

    Is there a configuration How-to on this?  Particularly, I'm wondering -

    How do you identify the source interface of the fprobe?  In /etc/default/fprobe-ulog?  That file is missing.
    How do you start the service?  /etc/init.d/fprobe-ulog ?  That file is missing as well.

    Docs on fprobe-ulog are not so great…

     
  • hoffswell:

    2 options for using netflow on NST:

    1) Use the NST WUI and go to the NfSen - Netflow Sensor Management page. You can start up a nflow probe using "ipt_netflow"

    From the NST Menu:  Network => Monitors =>   Netflow Sensor Management

    Then use the graphical web-based netflow output with NfSen…

    2) Use fprobe-ulog. This requires also the use of iptables. There is no startup script in /etc/init.d. So you will need to create one.


    Example systemd startup script: "/lib/systemd/system/fprobe-ulog"

    Description=NST Boot Service
    After=syslog.target network.target

    EnvironmentFile=/etc/sysconfig/fprobe-ulog
    ExecStart=/usr/bin/fprobe-ulog $OPTIONS

    WantedBy=multi-user.target

    $OPTIONS can be defined in file: "/etc/sysconfig/fprobe-ulog"

    OPTIONS="-Xeth0:100 localhost:9996"

    A) First setup you iptables for logging. In this example we will log all flows on the NST probe.

    iptables -t filter -N ULOGFLOW
    iptables -A ULOGFLOW -j ULOG -ulog-nlgroup 1 -ulog-cprange 48 -ulog-qthreshold 50
    iptables -t filter -A INPUT -j ULOGFLOW
    iptables -t filter -A  OUTPUT -j ULOGFLOW
    iptables -t filter -A FORWARD -j ULOGFLOW
    iptables -L -v

    b) Run the fprobe-ulog netflow probe. Example Run it on interface eth0 and sent it to localhost port 9996
    fprobe-ulog "-Xeth0:100" localhost:9996

    c) To test the example above use 'ncat' on the same probe
    ncat -u -l 127.0.0.1 9996 | hexdump -C

     
  • Pete hoffswell
    Pete hoffswell
    2012-11-15

    Good stuff. 

    I am seeing a bit of traffic, but only local NST traffic.  I would like to monitor all traffic that is sent to port p1p1, that is connected to a Cisco mirror port:

    9-CORE#show mon
    Session 1
    ---------
    Type                   : Local Session
    Source Ports           : 
        Both               : Gi3/24  ### WAN Link
    Destination Ports      : Gi2/19 ### Probe port p1p1
        Encapsulation      : Native
              Ingress      : Disabled
             Learning : Disabled
    Filter Pkt Type        : 
        RX Only       : Good
    9-CORE#
    

    iptables looks like this:

    [root@probe ~]# iptables -L -v
    Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination         
    34046 1503K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
       43  1290 ACCEPT     icmp --  any    any     anywhere             anywhere            
        0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
        0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             state NEW tcp dpt:ssh
       18   912 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited
        0     0 ULOGFLOW   all  --  any    any     anywhere             anywhere            
    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination         
        0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited
        0     0 ULOGFLOW   all  --  any    any     anywhere             anywhere            
    Chain OUTPUT (policy ACCEPT 36479 packets, 6382K bytes)
     pkts bytes target     prot opt in     out     source               destination         
    36523 6387K ULOGFLOW   all  --  any    any     anywhere             anywhere            
    Chain ULOGFLOW (3 references)
     pkts bytes target     prot opt in     out     source               destination         
    36523 6387K ULOG       all  --  any    any     anywhere             anywhere             ULOG copy_range 48 nlgroup 1 queue_threshold 50
    [root@probe ~]#
    

    This does not seem to forward all flows, but only the local flows (ssh session, vnc, etc)

    Incidentally, this iptable config seems to break the https: access to my NST Installation.

    I start fprobe-ulog to process interface p1p1 that is my probe port with:

    [root@probe ~]# fprobe-ulog -Xp1p1:100 10.1.3.81:9996
    

    Any further thoughts?

     
  • Have you tried the NST WUI and go to the NfSen - Netflow Sensor Management page?

    --RWH

     

  • Anonymous
    2012-11-19

    Good morning -

    No, I have not.  But I am trying to get frprobe-ulog to send flows to my netflow collector.  A different box.

    I can try using the WUI and NfSen for testing, if that's what you were thinking….

     
  • I was suggesting to see if this configuration (i.e., WUI with Nfsen) works first to see if you get the desired results and then try troubleshooting frprobe-log next…

    --RWH

     
  • Also one can use nfreplay if the WUI and Nfsen works to send the results to your netflow collector…

     
  • Pete hoffswell
    Pete hoffswell
    2012-11-20

    Greetings.

    Thanks for helping me through this issue, which isn't really an NST issue.  :)

    I can get ipt_netflow to work, delivering flows into the local nfsen installation.  But, from what I see, it is only processing packets that show up on my main interface.  This is the interface with an ip address, and used for probe management.

    The secondary port, p1p1, has a port mirror dumping traffic from our wan link.  ipt_netfow doesn't seem to take this one into the mix.

    How do I add port p1p1 to the flow in ipt_netflow?

     
  • As far as I know, ipt_netflow can only be used to provide information about packets routed through the system it is running on (the NST system in this situation). I don't think it can be used to monitor traffic routed by other systems using a stealth interface.