Friday, June 05, 2015

Minimal Netflow Sensor Station with OpenBSD 5.7 

The basics:

Default install of OpenBSD 5.7 amd64.

I start ntpd by default so I'll have accurate time stamps in my logs.
Get the network interfaces up and running.

In the default /etc/pf.conf rules, add the following line to the top:
set state-defaults pflow

Add the following to /etc/hostname.pflow0
flowsrc flowdst

Then "pkg_add flowd" to install the collector.  By default it listens only on localhost port 12345.

Add "/usr/local/sbin/flowd" to /etc/rc.local to cause it to start at boot.

It will start logging to /var/log/flowd

You can view the netflow logs with "flowd-reader /var/log/flowd"

More advanced:

We'll use the nfdump tools for our collector and reporting.

pkg_add nfdump

The nfcapd netflow capture daemon will replace flowd, and listens on port 9995 by default.  Modify /etc/hostname.pflow0 to contain the following:
flowsrc flowdst

Also, modify /etc/rc.local and remove the line that starts flowd, and replace it with (all on one line):
/usr/local/bin/nfcapd -D -z -w -n localhost,,/var/log/netflow -T all -S 2

You will also need to create the /var/log/netflow directory.

You can now use the nfdump tool to view one of the files which are created every 5 minutes.  Files are in sub-directories based on year, month, day, hour. For example:
nfdump -r /var/log/netflow/2015/06/05/13/nfcapd.201506051335 -s dstip

Or to view them all use the capital R option:
nfdump -R /var/log/netflow/2015/06/05/13 -s dstip

If you are already in a particular directory, use the back tic around the pwd command:
nfdump -R `pwd` -s dstip

You can also select other stats like dstport, etc.  Here are some of them.  See the man page for more.
recordStatistic about aggregated netflow records.
srcipStatistic about source IP addresses
dstipStatistic about destination IP addresses
ipStatistic about any (source or destination) IP addresses
srcportStatistic about source ports
dstportStatistic about destination ports
portStatistic about any (source or destination) ports
protoStatistic about protocol numbers

There is also a filter syntax if you wanted to look for a particular IP address for example, surround the filter expression by single quotes (different from the back tic):
nfdump -R `pwd` 'IP'

Using a Different Sensor 

Why don't we try softflowd as a sensor.  You can undo all the /etc/pf.conf and /etc/hostname.pflow0 stuff. The new daemon will listen promiscuously to the network, sof the pf packet filter doesn't need to be involved. "pkg_add softflowd"

Now go ahead and edit /etc/rc.conf.local and add the following lines (and change bge0 to whatever your network interface is):

softflowd_flags="-i bge0 -n"

Reboot to do the lazy start of all daemons. You can check to make sure it is all working by issuing the command:softflowctl statistics

This page is powered by Blogger. Isn't yours?