search

pavel-odintsov / fastnetmon

FastNetMon - very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
https://fastnetmon.com
GNU General Public License v2.0
3.37k stars 557 forks source link

Feature request: Add support for Cisco ASA Netflow(NSEL) #481

Closed ZerxXxes closed 11 months ago

ZerxXxes commented 8 years ago

Cisco ASA-firewalls utilizes NetFlow v9 fields and templates but is not currently supported by fastnetmon as they use some different kind of events. http://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/guide/asa_netflow.html

The same information should be able to be extracted from NSEL, the ntop-project was able to add support for it some time ago: http://www.ntop.org/ntop/ntop-asa-support/

pavel-odintsov commented 1 year ago

We've reworked Netflow logic many times since 2016 and I think we may support these fields.

If you can test it now and share pcap with ASA's Netflow it would be great.

Thank you.

pavel-odintsov commented 1 year ago

Update 2023: Cisco ASA uses very different encoding logic and encodes each traffic flow using bi-directional flow. We've added PoC level logic for it in FastNetNetMon Advanced and looking for more testers.

pavel-odintsov commented 11 months ago

Support was added :) Please try latest builds: https://fastnetmon.com/install/