The servers on which I plan to generate netflow data are all Gentoo systems, but this shouldn't really make any difference. At most it means I would have to manually compile a tool from source. Summary: I'm looking for an opensource netflow generator that will work on Linux and allows capturing flows for multiple interfaces.

Feb 25, 2010 · I store (ip, flows, in bytes, outbytes) every five minutes and the database is reasonably usable. I tried dumping netflow data into a database, and found it storage-intensive and incredibly slow to access. For specific flow information, linear searches through netflow files turned out to be faster in all cases (of the scenarios we tried anyways).

The other variables are the Netflow version - old style V1/V5/V7 vs V9, the latter of which has capabilities for aggregation, summarization and customization. The other potential point is the use of Netflow sampling (on the higher end / SP side of Cisco). What I can advise is that scaling Netflow is usually pretty linear. Your best bet by far ...

Nov 2, 2011 · To check if iptables configuration is blocking it is generally advisable to temporary disable iptables (except for NETFLOW rules of course). Also check dmesg as there may be important kernel/module messages. Older version of NETFLOW module should have sysctl net.netflow.destination set after interfaces are UP.

Apr 1, 2015 · I'm currently working on replacing our existing Netflow collector that is EOL with a new one. The goal is to support around 4 million flows/minute and have HA capabilities. Below is my initial thought: Network devices --> F5 Load Balancer --> 3 Linux servers running a collector --> Forward Netflow to other devices as needed

The router is very important, so we are not allowed to enable Netflow on the router itself. Instead, it will have port mirroring enabled so that it can mirror traffic to another network device. We have now two options: a) Using software Netflow probe on a Linux server such as nProbe to convert the mirrored traffic into Netflow

Mar 14, 2017 · If you google the term "netflow exporter" or "software netflow exporter" you'll come up with a couple more. ("exporter" seems to be the more common term than "sensor" for some reason) – John Murphy

Using IPTables on a Linux box to route the SNMP traps with NATing; We've currently implemented and are testing the last solution, with a Linux box with IPTables configured to receive the traps, and then depending on the source address of the trap, rewrite it with a destination nat (DNAT) so the packet gets sent to the proper server. For example:

Some routers (particularly cisco gear) come with netflow capture, and it can also be configured into other routers via third party firmware, or of course you can run it on your linux system. If you wish, many collection points can forward their flow data to a single collector.

The big bottleneck is going to be the NetFlow parsing, but using an open source NetFlow library like flowd will be a big help there. That will take care of all the versioning information, and should provide a convenient data structure for forming your syslog message.