search

irino / softflowd

softflowd: A flow-based network traffic analyser capable of Cisco NetFlow data export software.
https://github.com/irino/softflowd
Other
162 stars 29 forks source link

softflowd does not report direction and if_name in v9 which is important metrics #22

Closed pwp333 closed 4 years ago

pwp333 commented 4 years ago

softflowd does not report direction and if_name in v9 which is important metrics

DIRECTION 61 IF_NAME 82

Could we add these?

irino commented 4 years ago

I added these IEs on the latest commit ead968d2843019dfb9e686f1c114833be761b32c .

pwp333 commented 4 years ago

Thanks a lot Hitoshi! We appreciate your help!

pwp333 commented 4 years ago

Hi Hitoshi, would it be possible to add these real interface name in netflow9.c? Currently if_name = 'any' if user passes -i any in command line. Can we pass in the real interface name like eth0 / eth1. Or we could use the following values. Thanks a lot.

252:

253:

irino commented 4 years ago

I have no idea to lookup interface name when "any" is specified, because pcap_dispatch function doesn't have interface information. I think it is better to run each softflowd process for each interface.

pwp333 commented 4 years ago

Thanks Hitoshi for the info. Does softflowd cache flow in memory? Was worried if multiple softflowd process can take much memory.

irino commented 4 years ago

Yes, cache is on memory. If you worry the amount of memory, I think it is better to use limitation of number of flows by -m option.

jbhardman commented 2 years ago

Probably something I should know how it works, but is there anyway to get this update into the version of softflowd distributed in the pfsense package manager? There is no direction there for IPFIX and I would really like to get that. Thanks! @irino

jbhardman commented 2 years ago

I compiled from current source on FreeBSD and replaced the two binaries on my pfSense host that came with the package manager. This now includes Direction in the template. Thanks.