Installing Flow-Tools, Flow - Scan and RRDTool

based on Net-flow Howto (http://www.lin!gee".o#g/netflow-howto.php$

Softwa#e %ac"ages needed
"Apache- the web se#&e#
"Perl5
"RRDTool
"ta# -'!&f ##dtool-(.).*+.ta#.g'
"cd ##dtool-(.).*+
"./config#e --enable-sha#ed --p#efi!,/s#/local/##dtool
"-a"e install site-pe#l-install
"flow-tools
"ta# -'!&f flow-tools-)....ta#.g'
"cd flow-tools-)...
"./config#e
"-a"e
"-a"e install
This will install flow-tools to /s#/local/netflow.
"Perl Modules- In addition to %e#l+, /o will need the -odles listed below.
Net::%at#icia
0olde#::St#ea-
HT12::Table
3onfigReade#::Di#ecti&eSt/le
3flow
Download each of these f#o- the lab se#&e#, and #n the following
4 pe#l 1a"efile.%2
4 -a"e
4 -a"e install
In case of 3onfigReade#, 5st cop/ the n'ipped file to /s#/lib/pe#l+/site6pe#l/+.7.8/3onfigReade#/
3Flow is inclded in the c##ent flow-tools dist#ibtion so /o do not need to download it
sepa#atel/. %lease install it b/ doing the following:
"cd flow-tools-)...
"cd cont#ib
"ta# -'!&f 3flow-(.)+(.ta#.g'
"cd 3flow-(.)+(
"pe#l 1a"efile.%2
"-a"e
"-a"e install
"FlowScan- This is the #epo#t gene#ating application b/ Da&e %lon"a.
"CUFlow- This is the #epo#t -odle and g#aph gene#ato# w#itten b/ 3ol-bia 9ni&e#sit/ fo# FlowScan.
"Support Files - This incldes the sc#ipts and the pdated FlowScan.p- -odle that a#e needed to
co-plete the installation sing this doc-ent.
Router Configuration
Global Mode
ip cef
ip flow-e!po#t &e#sion + pee#-as
ip flow-e!po#t so#ce inte#face fa)/(
ip flow-e!po#t destination ().(.).( ())(
ip flow-cache ti-eot acti&e (
Interface Configuration
ip #ote-cache flow
9ni! %:TH ;a#iables
1a"e s#e that /o# Netflow and RRDTools e!ectables a#e in the %:TH.
4 echo <%:TH
:dd it to /etc/p#ofile,
if = >id -> , ) ?@ then
path-nge /sbin
path-nge /s#/sbin
path-nge /s#/local/sbin
path-nge /s#/local/##dtool/bin
path-nge /s#/local/netflow/bin
fi
o# lin" the e!ectables to /s#/local/bin
Flow-tools Configuration
Flow-tools donAt need f#the# config#ation, if /o a#e happ/ #nning it f#o- the co--and line. 0t to be able to
&iew g#aphs, few things needs to be added.
Fi#st c#eate the app#o#iate di#ecto#ies
4-"di# -p /&a#/netflow/
4-"di# -p /&a#/netflow/ft
4-"di# -p /&a#/netflow/##ds
4-"di# -p /&a#/netflow/sco#eboa#d
Now cop/ the file Alin"-eA f#o- the sppo#t files to B/s#/local/netflow/bin/C. The lin"-e file lin"s the c##ent
flow capt#e file to flow-scan p#ocess late#.
Start flow-capture
4/s#/local/netflow/bin/flow-capt#e -w /&a#/netflow/ft )/)/D)++ -S+ -;+ -E(F -n D7G -N ) -R /
s#/local/netflow/bin/lin"-e
Ho can se the Bflow-capt#e-initC file p#o&ided in the sppo#t files.
Configuring Flow-Scan
Since flow-tools will not p#ocess the #aw flows, we will need additional tools to &iew the p#ocessed g#aphs.
Download the file f#o- the local se#&e#. :nd #n the following co--ands
./config#e --p#efi!,/&a#/netflow
-a"e
-a"e -n install
-a"e install
cd cf
cp flowscan.cf /&a#/netflow/bin
cp 3a-psII.cf /&a#/netflow/bin
cp SbNetII.cf /&a#/netflow/bin
Now, #eplace the flowscan.p- file in the /&a#/netflow/bin, with the one p#o&ided with the sppo#t files.
Installaing CUFlow
Je a#e sing an additional g#aphing class. Ho can also se the al#ead/ inclded with flow-tools, which a#e
ca-psII and sbnetII.
Download and nta# 39Flow
cop/ 39Flow.p- and 39Flow.cf to /&a#/netflow/bin/
Edit the 39Flow.cf file in the /&a#/netflow/bin di#ecto#/.
Sbnet ().(.).)/D)
Netwo#" ().(.).)/D* #ote#s
ItptDi# /&a#/netflow/##ds
Sco#eboa#d () /&a#/netflow/sco#eboa#d /&a#/www/ht-l/flows/topten.ht-l
Rote# ().(.).D+* #ote#(
na!ling Flow-Scan to wor" with CUFlow
Edit the /&a#/netflow/bin/flowscan.cf file to #ead the follows
FlowFileFlob /&a#/netflow/ft-&)+K=)-L?
4Repo#t3lasses 3a-psII
Repo#t3lasses 39Flow
Starting Flow-scan
se the Bflowscan-initC file p#o&ided with the sppo#t files to sta#t flow-scan.
Do a Btail -f /&a#/log/flowscanC to see if /o# flow-scan is wo#"ing p#ope#l/.
#e! Interface
39F#aphe# co-es with a pe#l file that will p#o&ide an f#ont end fo# &iewing g#aphs.
3op/ the 39F#aphe#.pl file to /&a#/www/cgi-bin/
Edit the 39FRaphe#.pl file to -atch the ##d file di#ecto#/
$% &rrddir ' ()*ar)netflow)rrds(+
Ho shold now be able to gene#ate g#aphs f#o- the flow data.