softflowd

A software flow probe: it reads packets from a card (or a capture file, -r), keeps a flow cache keyed by addresses, ports and protocol, and sends each finished flow to the collector given with -n. Timeouts (-t) decide when a flow counts as finished; -s samples one packet in N. softflowctl talks to the running daemon: list the cache, statistics, or force an export.

softflowd command usage

softflowd -i CARD -n COLLECTOR:PORT [-v 5|9|10] [-t NAME=SECONDS]... [-s N] [-d|-D]
softflowd -D -r FILE.pcap -n COLLECTOR:PORT
softflowctl dump-flows|statistics|expire-all

Options

-i flowtap

the card to watch

-n 10.0.3.10:2055

where to export

-v 5

NetFlow v5 (9: v9, 10: IPFIX)

-t maxlife=20

the active timeout: export a flow after 20 seconds even if it goes on

-t tcp=5 / general=5

inactive timeouts: export after that many quiet seconds

-s 10

sample one packet in ten

-r file.pcap

read a capture file instead of a card

-d / -D

stay in the foreground; -D also prints each flow and the statistics

softflowd examples

softflowctl dump-flows

Lists the flows the running probe is counting right now.

softflowctl statistics

Shows how many flows expired, and why: FIN, timeouts, maxlife.

softflowctl expire-all

Exports every flow in the cache now.

softflowd -i eth0 -n 10.0.3.10:2055 -v 5

Watches eth0 and exports NetFlow v5 to the collector at 10.0.3.10.

softflowd -D -r /tmp/office.pcap -n 127.0.0.1:9 -s 10

Turns a capture file into flows, sampling one packet in ten, and prints the statistics.

Pitfalls

• A long flow is only exported at the active timeout (maxlife, 30 minutes by default on many exporters): collectors see it late.
• The collector port must match on both ends; nothing tells the exporter its records are dropped.

Run it on real machines