41 lines
2.2 KiB
Markdown
41 lines
2.2 KiB
Markdown
# Python NetFlow v9 parser and UDP collector
|
|
This script is able to parse incoming UDP NetFlow packets of **NetFlow version 9**.
|
|
|
|
Version 9 is the first NetFlow version using templates.
|
|
Templates make dynamically sized and configured NetFlow data flowsets possible,
|
|
which makes the collector's job harder.
|
|
|
|
## Using the collector and analyzer
|
|
In this repo you also find `main.py` and `analyze_json.py`.
|
|
|
|
To start an example collector run `python3 main.py -p 9000 -D`. This will run
|
|
a collector at port 9000 in debug mode. Point your flow exporter to this port on
|
|
your host and after some time the first ExportPackets should appear (the flows
|
|
need to expire first).
|
|
|
|
After you collected some data, `main.py` exports them into JSON files, simply
|
|
named `<timestamp>.json`.
|
|
|
|
To analyze the saved traffic, run `analyze_json.py <json file>`. In my example
|
|
script this will look like the following, with flows filtered for a size bigger
|
|
than one megabyte and with resolved hostnames and services:
|
|
|
|
2017-10-28 23:17.01: SSH from localmachine-1 (<IPv4>) to localmachine-2 (<IPv4>) size 4.25M
|
|
2017-10-28 23:19.01: HTTP from uwstream3.somafm.com (173.239.76.148) to localmachine-2 (<IPv4>) size 22.79M
|
|
2017-10-28 23:22.01: HTTPS from fra16s12-in-x0e.1e100.net (2a00:1450:4001:818::200e) to localmachine-2 (<IPv6>) size 1.21M
|
|
2017-10-28 23:32.01: HTTPS from fra16s12-in-x0e.1e100.net (2a00:1450:4001:818::200e) to localmachine-2 (<IPv6>) size 1.60M
|
|
2017-10-28 23:32.01: HTTPS from fra16s14-in-x0e.1e100.net (2a00:1450:4001:81a::200e) to localmachine-2 (<IPv6>) size 3.01M
|
|
2017-10-28 23:44.28: HTTP from localmachine-3 (<IPv4>) to localmachine-2 (<IPv4>) size 2.00G
|
|
|
|
Feel free to customize the analyzing script, e.g. make it print some
|
|
nice graphs or calculate broader statistics.
|
|
|
|
## Resources
|
|
* [Cisco NetFlow v9 paper](http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html)
|
|
* [RFC "Cisco Systems NetFlow Services Export Version 9"](https://tools.ietf.org/html/rfc3954)
|
|
|
|
## Development environment
|
|
I have specifically written this script in combination with NetFlow exports from
|
|
[softflowd](https://github.com/djmdjm/softflowd) v0.9.9 - it should work with every
|
|
correct NetFlow v9 implementation though.
|