| SOFTFLOWD(8) | System Manager's Manual | SOFTFLOWD(8) |
softflowd —
Traffic flow monitoring
softflowd |
[-6dDhbalN] [-L
hoplimit] [-T
track_level] [-c
ctl_sock] [-i
[if_ndx:]interface]
[-m max_flows]
[-n host:port]
[-p pidfile]
[-r pcap_file]
[-t timeout_name=seconds]
[-v netflow_version]
[-P transport_protocol]
[-A time_format]
[-s sampling_rate]
[-C capture_length]
[-R receive_port]
[-S send_interface_name]
[-x number_of_mpls_labels]
[bpf_expression] |
softflowd is a software implementation of
a flow-based network traffic monitor. softflowd
reads network traffic and gathers information about active traffic flows. A
"traffic flow" is communication between two IP addresses or (if
the overlying protocol is TCP or UDP) address/port tuples.
The intended use of softflowd is as a
software implementation of Cisco's NetFlow(tm) traffic account system.
softflowd supports data export using versions 1, 5,
9 or 10 (a.k.a. IPFIX) of the NetFlow protocol.
softflowd can also run in statistics-only mode,
where it just collects summary information. However, too few statistics are
collected to make this mode really useful for anything other than
debugging.
Network traffic may be obtained by listening on a promiscuous
network interface (unless the -N option is given) or
by reading stored pcap(3) files, such as those written by
tcpdump(8). Traffic may be filtered with an optional
bpf(4) program, specified on the command-line as
bpf_expression. softflowd is
IPv6 capable and will track IPv6 flows if the NetFlow export protocol
supports it (currently only NetFlow v.9 possesses an IPv6 export
capability).
softflowd tries to track only active
traffic flows. When the flow has been quiescent for a period of time it is
expired automatically. Flows may also be expired early if they approach
their traffic counts exceed 2 Gib or if the number of flows being tracked
exceeds max_flows (default: 8192). In this last case,
flows are expired oldest-first.
Upon expiry, the flow information is accumulated into statistics
which may be viewed using softflowctl(8). If the
-n option has been specified the flow information is
formatted in a UDP datagram which is compatible with versions 1, 5 or 9 of
Cisco's NetFlow(tm) accounting export format. These records are sent to the
specified host and port. The
host may represent a unicast host or a multicast group.
The command-line options are as follows:
-n
host:port-N-i
[if_ndx:]interface-i or the -r options must
be specified.-r
pcap_filesoftflowd should read from a
pcap(3) packet capture file (such as one created with
the -w option of tcpdump(8))
file rather than a network interface. softflowd
processes the whole capture file and only expires flows when
max_flows is exceeded. In this mode,
softflowd will not fork and will automatically
print summary statistics before exiting.-p
pidfile-c
ctlsock-m
max_flows-t
timeout_name=time-dsoftflowd should not fork and
daemonise itself.-6softflowd to track IPv6 flows even if the
NetFlow export protocol does not support reporting them. This is useful
for debugging and statistics gathering only.-Dsoftflowd in a debugging mode. This implies
the -d and -6 flags and
turns on additional debugging output.-B
size_bytes-b-a-l-x
number_of_mpls_labels-h-L
hoplimitsoftflowd will use the default system TTL when
exporting flows to a unicast host. When exporting to a multicast group,
the default TTL will be 1 (i.e. link-local).-T
track_levelsoftflowd should be
used to define a flow. track_level may be one of:
“ether” (track everything including source and destination
addresses, source and destination port, source and destination ethernet
address, vlanid and protocol), “vlan” (track source and
destination addresses, source and destination port, vlanid and protocol),
“full” (track source and destination addresses, source and
destination port and protocol in the flow, the default),
“proto” (track source and destination addresses and
protocol), or “ip” (only track source and destination
addresses). Selecting either of the latter options will produce flows with
less information in them (e.g. TCP/UDP ports will not be recorded). This
will cause flows to be consolidated, reducing the quantity of output and
CPU load that softflowd will place on the system
at the cost of some detail being lost.-v
netflow_versionsoftflowd should use for export of the flow data.
Supported versions are 1, 5, 9, 10(IPFIX), and psamp. Default is version
5.-P
transport_protocol-A
time_format-s
sampling_rate-C
capture_length-R
receive_port-S
send_interface_nameAny further command-line arguments will be concatenated together
and applied as a bpf(4) packet filter. This filter will
cause softflowd to ignore the specified traffic.
softflowd will expire quiescent flows
after user-configurable periods. The exact timeout used depends on the
nature of the flow. The various timeouts that may be set from the
command-line (using the -t option) and their
meanings are:
Flows may also be expired if there are not enough flow entries to hold them or if their traffic exceeds 2 Gib in either direction. softflowctl(8) may be used to print information on the average lifetimes of flows and the reasons for their expiry.
softflowd command-line arguments that
specify time may be expressed using a sequence of the form:
time[qualifier], where
time is a positive integer value and
qualifier is one of the following:
Each member of the sequence is added together to calculate the total time value.
Time format examples:
A daemonised softflowd instance may be
controlled using the softflowctl(8) command. This
interface allows one to shut down the daemon, force expiry of all tracked
flows and extract debugging and summary data. Also, receipt of a
SIGTERM or SIGINT will cause
softflowd to exit, after expiring all flows (and
thus sending flow export packets if -n was specified
on the command-line). If you do not want to export flows upon shutdown,
clear them first with softflowctl(8) or use
softflowctl(8) 's “exit” command.
softflowd to listen
on interface fxp0 and to run in statistics gathering mode only (i.e. no
NetFlow data export).softflowd to listen
on interface fxp0 and to export NetFlow v.5 datagrams on flow expiry to a
flow collector running on 10.1.0.2 port 4432.softflowd to listen
on interface fxp0 and to export NetFlow v.5 datagrams on flow expiry to a
flow collector running on 10.1.0.2 port 4432 and 10.1.0.3 port 4432.softflowd to listen
on interface fxp0 and to export NetFlow v.5 datagrams on flow expiry to a
flow collector running on 10.1.0.2 port 4432 and 10.1.0.3 port 4432 with
load balncing mode. Odd netflow packets will be sent to 10.1.0.2 port 4432
and even netflow packets will be sent to 10.1.0.3 port 4432.softflowd will track to 65536 and increases the
timeout for UDP flows to 90 seconds.softflowd on a single machine.softflowd is
in daemon mode. This location may be overridden using the
-p command-line option.softflowd
listens on this socket for commands from softflowctl(8).
This location may be overridden using the -c
command-line option.Currently softflowd does not handle
maliciously fragmented packets properly, i.e. packets fragemented such that
the UDP or TCP header does not fit into the first fragment. It will product
correct traffic counts when presented with maliciously fragmented packets,
but will not record TCP or UDP port information. Please report bugs in
softflowd to https://github.com/irino/softflowd/issues
Damien Miller
⟨djm@mindrot.org⟩
Hitoshi Irino (current maintainer)
⟨irino@sfc.wide.ad.jp⟩
softflowctl(8), tcpdump(8), pcap(3), bpf(4)
http://www.ietf.org/rfc/rfc3954.txt
http://www.cisco.com/en/US/products/sw/netmgtsw/ps1964/products_implementation_design_guide09186a00800d6a11.html http://www.ietf.org/rfc/rfc5101.txt
http://www.ietf.org/rfc/rfc5103.txt
| November 17, 2019 | Debian |