Administrace komentářů

Snazim sa na sieti rozbehat netflow, pre potrebu monitorovania. Nasiel som tento navod, ktory je primarne urceny pre centos. Ja pouzivam ubuntu server.

http://www.dynamicnetworks.us/netflow/5-configure-flow-tools.html


Podla navodu som chcel vytvrorit skript: /usr/local/netflow/bin/linkme , ale cesta /usr/local/netflow neexistovala. (nainstaloval som uz netflow-tools).
Takze som vytvoril cesty:
[code]sudo mkdir /usr/local/netflow
sudo mkdir /usr/local/netflow/bin[/code]

nasledne som vytvoril v text. editore skript: [code]sudo nano -w /usr/local/netflow/bin/linkme[/code] a toto som vlozil do neho:
[code]#!/usr/bin/perl

$base = "/var/netflow";

if ($ARGV[0] =~ /.*[\/]*(ft-v05[^\/]*$)/) {
$fileName = $1;
} else {
print "Must specify file\n";
exit 1;
}
unless ( symlink("$base/ft/$fileName","$base/$fileName") ) {
print "Unable to create symbolic link: $base/$fileName\n";
exit 1;
}[/code]
urobil som prava pre dany skript aby bol spustatelny:
[code]sudo chmod a+x /usr/local/netflow/bin/linkme[/code]
vytvoril som priecinky pre ukladanie dat:
[code]sudo mkdir -p /var/netflow/
sudo mkdir -p /var/netflow/bin
sudo mkdir -p /var/netflow/ft
sudo mkdir -p /var/netflow/rrds
sudo mkdir -p /var/netflow/scoreboard[/code]

v tom manuali je tento prikaz na spustenie flow-capture:
[code]sudo /usr/local/netflow/bin/flow-capture -w /var/netflow/ft 0/0/2055 -S5 -V5 -E1G -n 287 -N 0 -R /usr/local/netflow/bin/linkme[/code]
ale mne fungoval tento:
[code]sudo flow-capture -w /var/netflow/ft 0/0/2055 -S5 -V5 -E1G -n 287 -N 0 -R /usr/local/netflow/bin/linkme[/code]

tcpdump mi ukazoval prebiehajucu komunikaciu:
[code]tcpdump -n udp port 2055[/code]

pouzitim [code]sudo netstat -lnp[/code]
mi ukazalo ze flow-capture neni v stave listen:
[quote]Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      4304/mysqld     
tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      4655/smbd       
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      4746/apache2    
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      4627/exim4      
tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      4655/smbd       
tcp6       0      0 :::22                   :::*                    LISTEN      4206/sshd       
udp        0      0 0.0.0.0:2055            0.0.0.0:*                           4928/flow-capture
udp        0      0 192.168.76.4:137        0.0.0.0:*                           4653/nmbd       
udp        0      0 0.0.0.0:137             0.0.0.0:*                           4653/nmbd       
udp        0      0 192.168.76.4:138        0.0.0.0:*                           4653/nmbd       
udp        0      0 0.0.0.0:138             0.0.0.0:*                           4653/nmbd       
udp        0      0 192.168.76.4:123        0.0.0.0:*                           3600/ntpd       
udp        0      0 127.0.0.1:123           0.0.0.0:*                           3600/ntpd       
udp        0      0 0.0.0.0:123             0.0.0.0:*                           3600/ntpd       
udp6       0      0 fe80::21f:d0ff:fe36:123 :::*                                3600/ntpd       
udp6       0      0 ::1:123                 :::*                                3600/ntpd       
udp6       0      0 :::123                  :::*                                3600/ntpd       
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     11312    4304/mysqld         /var/run/mysqld/mysqld.sock
unix  2      [ ACC ]     STREAM     LISTENING     11747    4670/winbindd       /tmp/.winbindd/pipe
unix  2      [ ACC ]     STREAM     LISTENING     11749    4670/winbindd       /var/run/samba/winbindd_privileged/pipe
[/quote]
teraz neviem ci to je chyba

kontrola ci sa tvoria tmp:
[quote]sudo cd /var/netflow/ft[/quote]
[quote]sudo ls[/quote]
vysledok:
[quote]ft-v05.2009-10-04.105104+0200  ft-v05.2009-10-04.105500+0200  tmp-v05.2009-10-04.110000+0200[/quote]

subor /etc/init.d/flow-capture uz bol vytvoreny takze ho netrebalo vytvorit.

Instalacia flowscan:
[quote]sudo apt-get install flowscan[/quote] (nainstalovali sa aj potrebne perl moduly)

podla navodu pre flowscan som sa chcel: cd cf , ale pise ze cesta nebola najdena, viete poradit ako ziskavat data z flow-capture a zobrazovat a co robim nespravne?