NetFlow: who talks to whom

The idea

A probe sums each conversation into a flow record and exports it. edgeRouter, a Router, counts what alice, bob and carol in the office send to webServer, and collector keeps the records: who talked to whom, never what they said.

Steps

1. A flow: one conversation, summed up

   SNMP says how busy a link is, not who keeps it busy. On edgeRouter, softflowd keeps a flow for every conversation crossing the office card: its addresses, ports and protocol, with packet and byte counts. alice pings the web server three times; read the router's flow cache.

   alice:~# ping -c3 -i0.2 webServer.lab
   edgeRouter:~# softflowctl dump-flows

2. Exported to the collector

   A router keeps flows only briefly, so it hands them to a machine that keeps them. alice fetches the home page. When the connection ends, softflowd exports the flow to the collector over UDP port 2055; there nfcapd writes it to a file in /var/netflow every 5 seconds. List what the collector has.

   alice:~# curl -s http://webServer.lab/
   collector:~# nfdump -R /var/netflow