NetFlow on NetBSD?

[David Young]

Does the tech-net readership have any recommendations for an NetFlow
probe for NetBSD?

I want to monitor the rate and duration of network flows on a tiny
NetBSD firewall/router. I had hoped to find a tiny NetFlow "probe" to
install on the router.

I am not stuck on a NetFlow solution, BTW. If some other probe can be
made to work with traffic visualizers such as ntop, that will work for
me, too.

nProbe looks most promising, and it is even in pkgsrc[1], but it looks
like I have to pay a fee before I can download the (GPLv2) source.
softflowd and pfflowd at <http://www.mindrot.org/projects/> also look
promising. Can anybody say anything for/against them, or recommend some
other probe?

Dave

[1] nProbe's presence in pkgsrc is a good sign, however, I will
probably create a reachover build using the BSD make include
files for whichever probe I use.

[Masao Uebayashi]

OpenBSD has pflow(4) which is compatible to NetFlow version 5. I
guess it's not so difficult to port this.

http://www.openbsd.org/cgi-bin/man.cgi?query=pflow&apropos=0&sektion=0&manpath=OpenBSD+Current&format=html

Masao

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[David Young]

Post by Masao Uebayashi
OpenBSD has pflow(4) which is compatible to NetFlow version 5. I
guess it's not so difficult to port this.
http://www.openbsd.org/cgi-bin/man.cgi?query=pflow&apropos=0&sektion=0&manpath=OpenBSD+Current&format=html

It looks simple enough, but it is a strange use for the network
interface abstraction!

Dave

[Mihai Chelaru]

Post by David Young
Does the tech-net readership have any recommendations for an NetFlow
probe for NetBSD?

I use nProbe in a low traffic experimental setup (read: NOT IN
PRODUCTION). Seems OK, I capture netflows with flow-tools and ship them
in a mysql database. All packages are installed from pkgsrc. Load is
low, but as I said traffic is also low (around 1Mbps).