Closed ghost closed 2 years ago
Instead of using tcpreplay to send the traffic it can be used softflowd to read from a pcap file using the "-r" argument.
To use netflow v9 with goflow2:
goflow2:
build:
context: ./docker/goflow2
dockerfile: Dockerfile
hostname: goflow2
container_name: goflow2
ports:
- 9995:9995/udp
depends_on:
- kafka
restart: always
command:
- -transport=kafka
- -transport.kafka.brokers=kafka:9092
- -transport.kafka.topic=flows
- -format=json
- -listen=nfl://:9995 # to use netflow v5
# - -listen=netflow://:9995 # to use netflow v9 or v10 (IPFIX)
Pull merged in: https://github.com/netsampler/goflow2/pull/81
As proposed in https://github.com/netsampler/goflow2/issues/78 instead of modifying the FIRST_SWITCHED and LAST_SWITCHED is a better option to create new features:
TimeFlowStartMs
TimeFlowEndMs So it would not break any of the current implementations. First analyze the problem and see if it is feasable
[x] Make modifications on goflow2 to include those fields
[x] Create image from Dockerfile in SDA or goflow2 repo? -> Irrelevant as arguments are configured in the kubernetes template
[x] Use tcpdump to capture netflow traffic from softlow (192.168.165.138)
[x] Use tcpreplay to replay the captured traffic to do tests with goflow2
[x] Test modifcations on goflow2 are working
[x] Change modifications for other Netflow versions (v5, v9, v10)
[x] Make pull request
DOCUMENTATION