1 First of all sorry for my clumsy English.
6 fprobe-ulog: a NetFlow probe - libipulog-based tool that collect network
7 traffic data and emit it as NetFlow flows towards the specified
10 URL: http://fprobe.sourceforge.net
12 Compiling and installing:
13 =========================
15 Read INSTALL file for basic installation instructions. Below I'll try to
16 describe advanced compilation options.
18 --with-membulk=MODE indexing mode: index8|index16|ptr [default=ptr]
19 This option concerns to memory management and defines indexing mode and
20 maximum memory bulk size. I only shall tell, that the `index8' is most
21 frugal mode, `ptr' - fastest and `index16' somewhere in the middle.
23 --with-hash=TYPE hash type: xor8|xor16|crc16 [default=xor16]
24 fprobe-ulog use hashing to speedup flows cache searching. This option
25 specifies the hash type. `xor8' is very frugal with memory - it uses
26 only 1KB (on 32-bit systems) for hash structure while `xor16' and
27 `crc16' - 256KB. But, on the other hand, bigger hash gives better
29 Hash functions xor8 and xor16 faster then crc16, but they are vulnerable
30 to a DoS attack, as described in "Denial of Service via Algorithmic
31 Complexity Attacks" by Scott A Crosby and Dan S Wallach:
32 http://www.cs.rice.edu/~scrosby/hash
34 --enable-uptime_trick enable uptime trick [default=yes]
37 --enable-icmp_trick enable icmp trick: yes|cisco|no [default=yes]
38 If this option set to "yes" fprobe-ulog will store ICMP type and code in
39 srcport and dstport NetFlow fields.
40 If this option set to "cisco" only dstport field will used (ICMP type is
41 the higher eight bits and ICMP code is the lower eight bits). This
42 storing method used in some Cisco NetFlow implementations.
44 --enable-debug enable debugging [default=no]
45 You may select different events for debugging: (C)apture, (U)npending,
46 (S)can, (E)mit, (M)emory, (F)ill and (I)nfo. Most interesting (for end
47 user) from above is Info debugging - you may get general statistic about
48 captured packets, emitted flows, allocated memory, using kill -s USR1.
49 Don't forget to run fprobe-ulog with `-v7' otherwise you'll not see
52 --enable-debug (enable all events debugging)
53 --enable-debug=I,C,U,E (enable Info, Capture, Unpending and Emit debugging)
55 Brief explanation of Info debug messages:
56 I: received:[total packets]/[fragmented] ([total size])
57 pending:[now in queue]/[maximum]
58 I: ignored:[non-IP] lost:[pending queue full]+[no memory for caching]
59 I: cache:[flows]/[fragmented] emit:[sent datagrams]/[sent flows]/[flows
61 I: memory:[allocated flows]/[free] ([allocated memory in bytes])
63 --enable-messages enable runtime messages [default=no]
64 This option enables non-fatal runtime errors reporting. Be carefull - it
65 may flood your syslog.
67 --with-piddir=DIR pidfiles location [default=/var/run]
68 Directory to store pidfiles.
73 nProbe - NetFlow probe by Luca Deri:
74 http://www.ntop.org/nProbe.html
76 fprobe (namesake of mine project) - NetFlow probe by Bogdan Surdu:
77 http://psi.home.ro/flow
79 Softflowd - traffic analyzer capable of Cisco NetFlow data export:
80 http://www.mindrot.org/softflowd.html
82 Cisco's NetFlow links:
83 http://www.cisco.com/go/netflow
85 Excellent links collection about Network Monitoring and Analysis:
86 http://www.switch.ch/tf-tant/floma
91 Feel free to send any questions, comments, bug reports etc.
92 Contributions are welcome, including cosmetic fixes and pointing out
96 Slava Astashonok <sla@0n.ru>