Collector Flow-Tools

# tcpdump -nettti bnx0 udp and port 12345

$ sudo pkg_add flow-tools

    Configuration files for netflow-tools copied from samples  at 
	/usr/local/share/examples/flow-tools/cfg including: 
	
		* filter.cfg
		* stat.cfg - flow report definitions

# cp -R /usr/local/share/examples/flow-tools/cfg /etc

	A lot confused about the filter/stat features, and configuration? Michael W. Lucas' book ["Network Flow Analysis"](
    http://networkflowanalysis.com) provides a number of example uses, and modifications to the above configuration
	files to help you gain a better view of your network traffic.
	</td>
</tr>
<tr>
	<td>/var/netflow</td>
	<td>BASE Storage Location, all subsequent paths are
	    rooted in this path. In production you might prefer /var/netflow 
        as a separate partition with lots of space to ensure it
        doesn't mangle other work on the collector box.
        
        Refer to the sample storage utilisation below for a
        guesstimate of what you may need? But, run your collector
        to get a better understanding of your own requirements.</td>
</tr>
<tr>
	<td>sensorXY</td>
	<td>/var/netflow/sensorXY is the Netflow capture directory, 
    where *sensorXY* is the label and name for your sensor, which
    we reflect as the directory for netflow data exported from the
    sensor. Sample sensor names: wangateway, router1, finance_rtr</td>
</tr>

# mkdir -p /var/netflow/sensorXY
# cp -R /usr/local/share/examples/flow-tools/cfg /etc

flow-capture options ${collectorIP}/${sensorIP}/${port}

-p pidfile Configure the process ID file

-n rotations the number of times a new file per day. 

-S stat_interval log a timestamped message every stat_interval minutes indicating 
counters such as the number of flows received, packets processed, 
and lost flows. 

-w workdir set the workdir to /var/netflow. 

$ sudo flow-capture -p /var/run/flow-capture.pid -n 287 -w /var/netflow/sensorXY \
	-S 5 10.0.0.2/10.0.0.1/12345

$ ls /var/netflow/sensorXY/2012/2012-08/2012-08-12/

tmp-v05.2012-08-12.153413+1000

CAPTURE=/usr/local/bin/flow-capture
FLOWPID=/var/run/flow-capture.pid
DATA=/var/netflow
SENSOR=sensorXY
ipa_collector=XXX.XXX.XXX.XXX
ipa_sensor=XXX.XXX.XXX.XXX
port=12345

if [ -x ${CAPTURE} ]; then
	printf ' flow-capture'; ${CAPTURE} -p ${FLOWPID} -n 287 -w ${DATA}/${SENSOR} \
		-S 5 ${ipa_collector}/${ipa_sensor}/${port} && \
		echo "\t\t [OK]" || echo "\t\t [Failed]";
fi