[Nfsen-discuss] duplicate flows

[<ced...@gm...>]

hy nf-users,
Using nfsen and nfcapd from a few weeks, I'm now trying to install a scan
detector on my network. Ipflow's one seems an efficient one.
As i still want to use nfsen, i need to duplicate the flows I receive to 2
others ports.

I tried Pascal Gloor nfsplit tool but can't find how duplicate all traffic
coming from a defined router, using this config

local:129.20.x.x:9998
flow:129.20.y.z:0:129.20.x.x:9995

Don't seems to work, nfsplit run correctly but looking with ethereal,
nothing comes on 9995 port. Maybe isn't there any option to re-export all
flows.

I also tried netmet tool (netMetdup), very simple one but once running, the
flows coming on 9995 port seems to not contain datas (headers ?).
An other solution could be to declare an other destination/port on the
router but there is an limit of 2 address and the IOS refuse exporting twice
to the same destination address.


Did somebody always had this problem ? Is there an other way to duplicate
flows ?



I'm running ubuntu 6 on a gx270 dell.
nfsen works properly without duplicator (so the flows well formed by the
routers)
A cisco 6513 export V5 netflows and a 7204 export V9 flows. the same problem
appears on both.


Thanks for help