shiweifei

Linux使用FlowScan

Linux使用FlowScan完全安装配置指南

2015.04.30

1. Flowscan介绍

Flowscan采用Perl语言编写，主要用于处理展现网络设备发过来Netflow数据。

早先Flowscan利用cflow收集处理netflow v5数据，后来利用flow-tool收集处理netflow v5数据，

注意cflow需要在flow-tool下面编译供flowscan后期使用，然后flowscan对流进行扫描分析并绘图，

是一款挺不错的Netflow分析展现工具。

CUFlow是Flowscan一个扩展模块，比Flowscan自带的CampusIO和SubNetIO两个模块友好，因此

这里采用CUFlow模块替代自带的模块。

2. 检查或安装依赖软件

2.1. 检查Apache配置

Suse11:~ # apache2ctl -v

Server version: Apache/2.2.12 (Linux/SUSE)

Server built: Mar 27 2013 18:47:49

Suse11:~ # grep -v \^# /etc/sysconfig/apache2

DOC_SERVER="no"

APACHE_CONF_INCLUDE_FILES=""

APACHE_CONF_INCLUDE_DIRS=""

APACHE_MODULES="actions alias auth_basic authn_file authz_host authz_groupfile authz_default authz_user authn_dbm autoindex cgi dir env expires include log_config mime negotiation setenvif suexec userdir php5 reqtimeout"

APACHE_SERVER_FLAGS=""

APACHE_HTTPD_CONF=""

APACHE_MPM=""

APACHE_SERVERADMIN=""

APACHE_SERVERNAME=""

APACHE_START_TIMEOUT="2"

APACHE_SERVERSIGNATURE="on"

APACHE_LOGLEVEL="debug"

APACHE_ACCESS_LOG="/dev/null combined"

APACHE_USE_CANONICAL_NAME="off"

APACHE_SERVERTOKENS="OS"

APACHE_EXTENDED_STATUS="off"

APACHE_DISABLE_SSL_COMPRESSION="on"

Suse11:~ #

2.2. 检查Perl5安装

Suse11:~ # perl -v

This is perl, v5.10.0 built for x86_64-linux-thread-multi

Perl may be copied only under the terms of either the Artistic License or the

GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on

this system using "man perl" or "perldoc perl". If you have access to the

Internet, point your browser at http://www.perl.org/, the Perl Home Page.

Suse11:~ #

2.3. 编译安装RRDTool

# tar xvzf rrdtool-1.4.5.tar.tar

# cd rrdtool-1.4.5

修改configure,找到

PERL_MAKE_OPTIONS="PREFIX=$langpref INSTALL_BASE= LIB=$langpref/lib/perl/$PERL_VERSION"

修改为

PERL_MAKE_OPTIONS="PREFIX=$langpref INSTALL_BASE= LIB=$langpref/lib/perl5/$PERL_VERSION"

#./configure --prefix=/usr --sysconfdir=/etc --enable-shared

# make

# make install

或者make install site-perl-install

Suse11:~ # rrdtool -v

Compiled Apr 30 2015 14:21:19

Usage: rrdtool [options] command command_options

Valid commands: create, update, updatev, graph, graphv, dump, restore,

last, lastupdate, first, info, fetch, tune,

resize, xport, flushcached

RRDtool is distributed under the Terms of the GNU General

Public License Version 2. (www.gnu.org/copyleft/gpl.html)

For more information read the RRD manpages

Suse11:~ #

2.4. 编译安装flow-tools

2.4.1 下载flow-tools-0.68.5.1.tar.bz2

tar -xvjf flow-tools-0.68.5.1.tar.bz2

cd flow-tools-0.68.5.1

./configure --prefix=/usr --sysconfdir=/etc

make

make install

2.4.2 flow-tool的自启动脚本，于Cacti的flowview插件合用

Suse11:~ # cat /etc/init.d/flow-capture

#!/usr/bin/php

<?php

# description: Start Flow-Capture

# chkconfig: 2345 95 00

$cacti_base = '/srv/www/htdocs/cacti';

include_once($cacti_base . '/include/global.php');

$tools_path = read_config_option("path_flowtools");

if (isset($_SERVER['argv'][1])) {

switch (strtolower($_SERVER['argv'][1])) {

case 'start':

start();

break;

case 'stop':

stop();

break;

case 'restart':

restart();

break;

default:

echo "Usage: /etc/init.d/flow-capture {start|stop|restart}\n";

break;

}

function start() {

global $tools_path, $cacti_base;;

echo "NOTE: Starting Flow Tools\n";

$devices = db_fetch_assoc("SELECT * FROM plugin_flowview_devices");

if (!empty($devices)) {

$path = db_fetch_cell("SELECT value FROM `settings` WHERE name = 'path_flows_dir'");

if ($path == '')

break;

if (substr($path, -1) == '/') {

$path = substr($path, 0, -1);

}

foreach ($devices as $device) {

$port = $device['port'];

$folder = $device['folder'];

$nest = $device['nesting'];

$v = $device['version'];

$from = $device['allowfrom'];

$comp = $device['compression'];

$rotate = $device['rotation'];

$expire = $device['expire'] * ($rotate + 1);

if (!is_dir("$path/$folder")) {

echo "NOTE: Making directory '$path/$folder'\n";

mkdir("$path/$folder");

}

if (is_dir("$path/$folder")) {

echo "NOTE: Launching flow-capture as '$tools_path/flow-capture -w $path/$folder 0/$from/$port -S5 -V$v -z $comp -n $rotate -e $expire -N $nest'\n";

shell_exec($tools_path . "/flow-capture -w $path/$folder 0/$from/$port -S5 -V$v -z $comp -n $rotate -e $expire -N $nest");

}

}else{

echo "WARNING: No flows configured\n";

}

function stop() {

global $tools_path, $cacti_base;;

echo "NOTE: Stopping Flow Tools\n";

$devices = db_fetch_assoc("SELECT * FROM plugin_flowview_devices");

if (!empty($devices)) {

shell_exec('killall -9 ' . $tools_path . '/flow-capture');

}

function restart() {

stop();

start();

}

Suse11:~ #

2.4.3. 启动flow-capture

Suse11:~ # /etc/init.d/flow-capture start

NOTE: Starting Flow Tools

NOTE: Launching flow-capture as '/usr/bin/flow-capture -w /var/netflow/cisco3745 0/0/2055 -S5 -V5 -z 0 -n 1439 -e 525600 -N -1'

Suse11:~ # ps -eaf |grep flow-capture |grep -v grep

root 7087 1 4 20:32 ? 00:00:00 /usr/bin/flow-capture -w /var/netflow/cisco3745 0/0/2055 -S5 -V5 -z 0 -n 1439 -e 525600 -N -1

Suse11:~ #

2.5. 安装flowscan需要的Perl模块

Perl Modules- In addition to Perl5, you will need the modules listed below.

Net::Patricia

Boulder::Stream

HTML::Table

ConfigReader::DirectiveStyle

Cflow

从http://search.cpan.org/找到并下载这些包

# perl Makefile.PL

# make

# make install

对于ConfigReader, 解压缩到/usr/lib/perl5/site_perl/5.10.0目录即可

Suse11:~/bin/flow-tools-0.68.5.1 # ls -al /usr/lib/perl5/site_perl/5.10.0/ConfigReader

total 76

drwxr-xr-x 2 405 4 4096 Feb 20 1996 .

drwxr-xr-x 9 root root 4096 Apr 30 11:09 ..

-rw-r--r-- 1 405 4 25265 Feb 17 1996 COPYING.LIB

-rw-r--r-- 1 405 4 2424 Feb 14 1996 ConfigReader.pod

-rw-r--r-- 1 405 4 9084 Feb 20 1996 DirectiveStyle.pm

-rw-r--r-- 1 405 4 2152 Feb 19 1996 README

-rw-r--r-- 1 405 4 9705 Feb 20 1996 Spec.pm

-rw-r--r-- 1 405 4 7573 Feb 20 1996 Values.pm

Suse11:~/bin/flow-tools-0.68.5.1 #

注意，CFlow需要在flow-tools的环境下编译，因此该步骤需要在flow-tool编译完成后进行。

cd flow-tools-0.68.5.1

cd contrib

tar -zxvf Cflow-1.053.tar.gz

cd Cflow-1.051

perl Makefile.PL

make

make install

Suse11:~ # perl -MExtUtils::Installed -le 'foreach (ExtUtils::Installed->new->modules) { print $_,"-->", ExtUtils::Installed->new->version($_)}'

Boulder-->

Cflow-->1.053

HTML::Table-->2.08a

Net::CIDR-->0.18

Net::CIDR::Lite-->0.21

Net::Patricia-->1.22

Perl-->5.10.0

RRDp-->1.4009

RRDs-->1.4009

Socket6-->0.25

Test::Simple-->1.001014

Suse11:~ #

2.6. 安装并配置FlowScan

2.6.1. 检查Flowscan安装

目录Suse11:~ # ls -al /var/netflow/

total 24

drwxr-xr-x 4 root root 4096 Apr 30 19:34 .

drwxr-xr-x 16 root root 12288 Apr 26 18:13 ..

drwxr-xr-x 10 root root 4096 Apr 30 00:00 cisco3745

drwxr-xr-x 6 root root 4096 Apr 30 18:40 flowscan

Suse11:~ # ls -al /var/netflow/cisco3745/

total 656

drwxr-xr-x 10 root root 4096 Apr 30 00:00 .

drwxr-xr-x 4 root root 4096 Apr 30 19:34 ..

drwxr-xr-x 2 root root 36864 Apr 24 00:00 2015-04-23

drwxr-xr-x 2 root root 86016 Apr 25 00:00 2015-04-24

drwxr-xr-x 2 root root 81920 Apr 26 00:00 2015-04-25

drwxr-xr-x 2 root root 90112 Apr 27 00:00 2015-04-26

drwxr-xr-x 2 root root 90112 Apr 28 00:00 2015-04-27

drwxr-xr-x 2 root root 90112 Apr 29 00:00 2015-04-28

drwxr-xr-x 2 root root 86016 Apr 30 00:00 2015-04-29

drwxr-xr-x 2 root root 73728 Apr 30 19:38 2015-04-30

Suse11:~ # ls -al /var/netflow/flowscan/

total 1820

drwxr-xr-x 6 root root 4096 Apr 30 18:40 .

drwxr-xr-x 4 root root 4096 Apr 30 19:34 ..

drwxr-xr-x 2 root root 4096 Apr 30 18:40 flows

drwxr-xr-x 2 root root 4096 Apr 30 18:25 graphs

Suse11:~ #

2.6.2. 安装Flowscan

下载FlowScan-1.006.tar.gz

Suse11:~/bin # tar xvzf FlowScan-1.006.tar.gz

Suse11:~/bin # cd FlowScan-1.006/

Suse11:~/bin/FlowScan-1.006 # ./configure --prefix=/var/netflow/flowscan

Suse11:~/bin/FlowScan-1.006 # make

make: Nothing to be done for `all'.

Suse11:~/bin/FlowScan-1.006 # make -n install

test -d /var/netflow/flowscan/bin || /bin/mkdir -p /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c flowscan /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c FlowScan.pm /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c CampusIO.pm /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c SubNetIO.pm /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c util/locker /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c util/add_ds.pl /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c util/add_txrx /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c util/event2vrule /var/netflow/flowscan/bin

/root/bin/FlowScan-1.006/install-sh -c util/ip2hostname /var/netflow/flowscan/bin

Suse11:~/bin/FlowScan-1.006 # make install