Opensource NetFlow generator

Question

Cisco routers are able to generate NetFlow flows that can be captured and then analyzed in order to manage what is going on on your network. Unfortunately, I don't have a Cisco router in my toolbox so I'm looking for a opensource/free solution to generate the flows (act as a Cisco router) and to capture them.

I've already found this and this but it doesn't seems to generate flows, only ways to capture them.

Thank you

Answer 1

I think you are looking for softflowd:

Softflowd is flow-based network traffic analyser capable of Cisco NetFlow™ data export. Softflowd semi-statefully tracks traffic flows recorded by listening on a network interface or by reading a packet capture file. These flows may be reported via NetFlow™ to a collecting host or summarised within softflowd itself.

Softflowd can export using NetFlow version 1, 5 or 9 datagrams and it is fully IPv6 capable: it can track and report on IPv6 traffic and flow export datagrams can be sent to an IPv6 host. Any standard NetFlow collector should be able to process the reports from softflowd.

Answer 2

nProbe is a software based flow solution supporting NetFlow v5, v9, and IPFIX. Using the IPFIX capabilities of nProbe you can export far greater information about the traffic over traditional NetFlow:

HTTP - URLs and network/server latency

DNS - all name resolution activies

SIP,RTP - decodes VoIP traffic and is feature rich with caller-id, codec, dscp values, packet loss, and jitter. Everything you want when troubleshooting or reviewing voice.

nProbe is not free, however it is low cost. The rich detail it kicks out makes it a no-brainer if you have no other flow capable devices on your network.

YAF is Yet Another Flowmeter - This is a free tool supporting v5, v9, and IPFIX. It does not have all of the features that nProbe contains, however this is also a good solution.

If you are not savvy with linux, nProbe offers a Windows version.

Answer 3

The second link you provided (switch.ch) lists a number of products that will create flows from network traffic. I've setup SiLK (which uses YAF) for doing exactly what you've described.