search

irino / softflowd

softflowd: A flow-based network traffic analyser capable of Cisco NetFlow data export software.
https://github.com/irino/softflowd
Other
162 stars 29 forks source link

bidirectional IPFIX not occurring #10

Closed keleathi closed 5 years ago

keleathi commented 5 years ago

I'm utilizing softflowd 0.9.9 on a FreeBSD (pfSense) system, exporting IPFIX to a Logstash instance. Based on commit d53e821bb744c2475858c4d604058e0a475d6177, I had expected to have bidirectional flows exported as defined in rfc5103, but I'm still getting 2 unidirectional flows for each communication.

Am I missing a config/compile option somewhere, or am I misunderstanding the rfc5103 support? Are there logs or additional data I can supply?

Thank you in advance!

irino commented 5 years ago

Did you run softflowd with -b option?

keleathi commented 5 years ago

In the man pages, I saw no "-b" option. The command I'm using is:

/usr/local/sbin/softflowd -i 1:re1 -n 192.168.6.51:4739 -v 10 -T vlan -t general=60 -t maxlife=0 -t expint=0 -t tcp=60 -t tcp.rst=60 -t tcp.fin=60 -t udp=60 -p /var/run/softflowd.re1.pid -c /var/run/softflowd.re1.ctl

Should I be using -b? I can give that a try. Thanks!

keleathi commented 5 years ago

That seems to have fixed it! (I also looked at /usr/local/sbin/softflowd -h, and there's no "-b" flag listed there either).

Thank you!

irino commented 5 years ago

I updated on the master branch.