NetFlow的一些知识

2017-03-09 本文已影响187人丁不想被任何狗咬

NetFlow如何决定方向：

Strategies used that attempt to determine flow direction but, aren’t entirely reliable include:

Comparison of flow start times

Lowest source port = server
The relationship of A and B with other hosts on the network. A host with many connections to unique hosts ‘could’ be a server.
Byte volumes: the host with the lower sent octet delta count is the client. This can be very misleading.
Observation of TCP flags however, due to flow technologies aggregation methods, this strategy generally fails.
Examining TTL metrics (if exported) – doesn’t provide a definitive answer.
Consideration of how the flows were metered (I.e. ingress or egress) however, this is unreliable as some vendors only support egress. In other cases both are exported. Frankly, I never really understood why this was a good strategy. Perhaps someone could share their insight on this.

总结：基于硬件，比较准确。

官方文档：

IP Flow Information Export (IPFIX) Entities
http://www.iana.org/assignments/ipfix/ipfix.xhtml
Bidirectional Flow Export Using IP Flow Information Export (IPFIX)
https://tools.ietf.org/html/rfc5103

>>  $ nfcapd -p9995 -l ./netflow/
>>  $ softflowd -n 127.0.0.1:9995 -r dump.pcap

时间戳不太对。而且一个双向流会被拆分成两个。

nfcapd -f pcap #办不到

tshark读取pcap

tcpreplay，centos