ng_netflow and bridging firewall

Ganbold ganbold at micom.mng.net
Tue Aug 30 10:34:55 GMT 2005


Hi Gleb and all,

I'm newbie to ng_netflow and I'm trying to collect Netflow traffic from 
FreeBSD 5.4 machine. Collector (flow-tools) runs on same machine.
This FreeBSD has 3 interfaces and it acts as bridging firewall using IPFW2.
It also uses dummynet.

host# ifconfig
xl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
         options=9<RXCSUM,VLAN_MTU>
         ether 00:10:5a:5b:e5:e3
         media: Ethernet 100baseTX <full-duplex>
         status: active
xl1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
         options=9<RXCSUM,VLAN_MTU>
         ether 00:04:76:dc:7f:d1
         media: Ethernet 100baseTX <full-duplex>
         status: active
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
         inet x.x.x.x netmask 0xffffffe0 broadcast x.x.x.x
         ether 00:0b:6a:24:f6:ab
         media: Ethernet autoselect (100baseTX <full-duplex>)
         status: active

I'm running ng_netflow module and ngctl with following parameters:

ngctl mkpeer xl1: tee lower right
ngctl connect xl1: xl1:lower upper left
ngctl name xl1:lower xl1_tee
ngctl mkpeer xl1_tee: netflow left2right iface0
ngctl name xl1:lower.left2right netflow
ngctl connect xl1_tee: netflow: right2left iface1
ngctl msg netflow: setifindex { iface=0 index=2 }
ngctl msg netflow: setifindex { iface=1 index=1 }
ngctl mkpeer netflow: ksocket export inet/dgram/udp
ngctl msg netflow:export connect inet/127.0.0.1:8818

I'm just using second xl1 interface for ng_netflow. However when I see the 
flow data I can only see my network addresses in
the dstIP field. Is it correct? I thought both srcIP, dstIP should contain 
my IPs,  because I'm trying to catch traffic which goes both directions of 
xl1. Is my assumption correct? If I'm wrong, how to make it work in correct 
way?

Another issue is firewall dynamic rules count almost doubles when starts 
ng_netflow traffic. Is it correct?
How can I fix this?

Also how can I include first interface xl0 to the ng_netflow configuration?

I appreciate if somebody can give me some hint and advice.
It would be great if someone can share configuration samples.

thanks in advance,

Ganbold





More information about the freebsd-isp mailing list