Building, configuring and running ipt-netflow on Debian Linux

General information

• ipt-netflow is the fastest netflow sensor (counter) for Linux.
• It consists of two modules: for the kernel and for iptables.
• In the standard kernel and iptables is not yet included - requires assembly from the source code!
• Debian inclusion is discussed - see lists.debian.org/debian-mentors/2011/04/msg00070.html and bugs.debian.org/cgi-bin/bugreport.cgi?bug=620511

System

• Debian Squeeze (6.0.3) amd64
• Kernel 2.6.38 from backports (the freshest at the time of this documentation)

Build on test system

• Install the necessary packages:
  

    apt-get install -t squeeze-backports linux-headers-2.6.38-bpo.2-amd64
   apt-get install -t squeeze-backports quilt debhelper autotools-dev iptables-dev dkms pkg-config 

  
  
• Download and unpack sourceforge.net/projects/ipt-netflow/files/ipt-netflow
• We compile and install into the assembly system:
  

    cd ./ipt_netflow- *
   ./configure
   make all
   make install
   depmod 

  
  
• Making an archive for installation on the gateway:
  

    find / lib -name "* NETFLOW *" |  xargs tar czf \
   / tmp / ipt_netflow - $ (modinfo -F version ipt_NETFLOW) - $ (uname -r) .tar.gz 

Installation on a production system

• Expand from archive
  

    tar xzf /tmp/ipt_netflow-*-*.tar.gz -C /
   depmod 

  
  
• Configure boot options (full list of parameters):
  

    echo options ipt_NETFLOW destination = 127.0.0.1: 9996> /etc/modprobe.d/netflow.conf 

  
  
• Load and check the status:
  

    modprobe ipt_NETFLOW
   sysctl -a |  grep net.netflow 

  
  
• We let traffic through the sensor:
  

    iptables -A FORWARD -j NETFLOW 

  
  
• Checking the count:
  

    iptables -nvL FORWARD |  grep NETFLOW
   tcpdump -c5 -npi lo port 9996 

  
  
• Turn on autoload:
  

    echo ipt_NETFLOW >> / etc / modules 

  
  
• Disable kernel update:
  

    echo linux-image-2.6.38-bpo.2-amd64 hold |  dpkg --set-selections 

  
  
• If the collector is on another computer, then at the time of loading the module, the interfaces and routing are not yet configured, the establishment of communication with the collector may end with a kernel error 101 (“destination unreached”). To bypass it, re-establish the connection from /etc/rc.local:
  

    f = "/ proc / sys / net / netflow / destination"
   test -e "$ f" && d = "$ (cat $ f)" && echo "$ d"> "$ f"