mirror of
https://github.com/akvorado/akvorado.git
synced 2025-12-12 06:24:10 +01:00
docs: Netflow → NetFlow
This commit is contained in:
@@ -1,6 +1,6 @@
|
||||
# Akvorado: flow collector, enricher and visualizer · [](https://github.com/akvorado/akvorado/actions/workflows/ci.yml) [](https://codecov.io/gh/akvorado/akvorado) [](LICENSE.txt) [](https://github.com/akvorado/akvorado/releases)
|
||||
|
||||
This program receives flows (currently Netflow/IPFIX and sFlow), enriches them
|
||||
This program receives flows (currently NetFlow/IPFIX and sFlow), enriches them
|
||||
with interface names (using SNMP), geo information (using IPinfo.io),
|
||||
and exports them to Kafka, then ClickHouse. It also exposes a web
|
||||
interface to browse the collected data.
|
||||
|
||||
@@ -54,7 +54,7 @@ var ConsoleOptions consoleOptions
|
||||
var consoleCmd = &cobra.Command{
|
||||
Use: "console",
|
||||
Short: "Start Akvorado's console service",
|
||||
Long: `Akvorado is a Netflow/IPFIX collector. The console service exposes a web interface to
|
||||
Long: `Akvorado is a NetFlow/IPFIX collector. The console service exposes a web interface to
|
||||
manage collected flows.`,
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
|
||||
@@ -45,7 +45,7 @@ var InletOptions inletOptions
|
||||
var inletCmd = &cobra.Command{
|
||||
Use: "inlet",
|
||||
Short: "Start Akvorado's inlet service",
|
||||
Long: `Akvorado is a Netflow/IPFIX collector. The inlet service handles flow ingestion,
|
||||
Long: `Akvorado is a NetFlow/IPFIX collector. The inlet service handles flow ingestion,
|
||||
and export to Kafka.`,
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
|
||||
@@ -79,7 +79,7 @@ var OrchestratorOptions orchestratorOptions
|
||||
var orchestratorCmd = &cobra.Command{
|
||||
Use: "orchestrator",
|
||||
Short: "Start Akvorado's orchestrator service",
|
||||
Long: `Akvorado is a Netflow/IPFIX collector. The orchestrator service configures external
|
||||
Long: `Akvorado is a NetFlow/IPFIX collector. The orchestrator service configures external
|
||||
components and centralizes configuration of the various other components.`,
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
|
||||
@@ -69,7 +69,7 @@ var OutletOptions outletOptions
|
||||
var outletCmd = &cobra.Command{
|
||||
Use: "outlet",
|
||||
Short: "Start Akvorado's outlet service",
|
||||
Long: `Akvorado is a Netflow/IPFIX collector. The outlet service handles flow ingestion,
|
||||
Long: `Akvorado is a NetFlow/IPFIX collector. The outlet service handles flow ingestion,
|
||||
enrichment and export to Kafka.`,
|
||||
Args: cobra.ExactArgs(1),
|
||||
RunE: func(cmd *cobra.Command, args []string) error {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Introduction
|
||||
|
||||
*Akvorado*[^name] receives network flows (currently Netflow/IPFIX and sFlow), enriches
|
||||
*Akvorado*[^name] receives network flows (currently NetFlow/IPFIX and sFlow), enriches
|
||||
them with interface names (using SNMP), geographic information (using
|
||||
[IPinfo](https://ipinfo.io/) or MaxMind), and exports them to ClickHouse via
|
||||
Kafka. It also provides a web interface to browse the results.
|
||||
|
||||
@@ -49,7 +49,7 @@ gets a section of the configuration file matching its name.
|
||||
## Inlet service
|
||||
|
||||
This service is configured under the `inlet` key. The inlet service receives
|
||||
Netflow/IPFIX/sFlow packets and forwards them to Kafka. The main components are
|
||||
NetFlow/IPFIX/sFlow packets and forwards them to Kafka. The main components are
|
||||
`flow` and `kafka`.
|
||||
|
||||
### Flow
|
||||
@@ -70,9 +70,9 @@ inside each worker. With `use-src-addr-for-exporter-addr` set to true, the
|
||||
source ip of the received flow packet is used as exporter address. It is also
|
||||
possible to choose how to extract the timestamp for each packet with
|
||||
`timestamp-source`: `udp` to use the receive time of the UDP packet (the
|
||||
default), `netflow-packet` to extract the timestamp from the Netflow/IPFIX
|
||||
default), `netflow-packet` to extract the timestamp from the NetFlow/IPFIX
|
||||
header, or `netflow-first-switched` to use the “first switched” field from
|
||||
Netflow/IPFIX.
|
||||
NetFlow/IPFIX.
|
||||
|
||||
For example:
|
||||
|
||||
@@ -110,7 +110,7 @@ flow:
|
||||
```
|
||||
|
||||
Without configuration, *Akvorado* will listen for incoming
|
||||
Netflow/IPFIX and sFlow flows on a random port (check the logs to know
|
||||
NetFlow/IPFIX and sFlow flows on a random port (check the logs to know
|
||||
which one).
|
||||
|
||||
### Kafka
|
||||
|
||||
@@ -48,7 +48,7 @@ service exposes its metrics under `/api/v0/outlet/metrics`.
|
||||
## Inlet service
|
||||
|
||||
`akvorado inlet` starts the inlet service, allowing it to receive
|
||||
Netflow/IPFIX/sFlow packets and forward them to Kafka. The inlet service
|
||||
NetFlow/IPFIX/sFlow packets and forward them to Kafka. The inlet service
|
||||
does not expose any service-specific HTTP endpoints.
|
||||
|
||||
## Outlet service
|
||||
|
||||
@@ -29,7 +29,7 @@ source IP! This might occur with Docker or Kubernetes networking.
|
||||
|
||||
### Cisco IOS-XE
|
||||
|
||||
Netflow can be enabled with the following configuration:
|
||||
NetFlow can be enabled with the following configuration:
|
||||
|
||||
```cisco
|
||||
flow record Akvorado
|
||||
@@ -91,7 +91,7 @@ flow monitor AkvoradoMonitor-IPV6
|
||||
!
|
||||
```
|
||||
|
||||
To enable Netflow on an interface, use the following snippet:
|
||||
To enable NetFlow on an interface, use the following snippet:
|
||||
|
||||
```cisco
|
||||
interface GigabitEthernet0/0/3
|
||||
@@ -115,7 +115,7 @@ inlet:
|
||||
|
||||
### NCS 5500 and ASR 9000
|
||||
|
||||
On each router, Netflow can be enabled with the following configuration. It is
|
||||
On each router, NetFlow can be enabled with the following configuration. It is
|
||||
important to use a power of two for the sampling rate (at least on NCS).
|
||||
|
||||
```cisco
|
||||
@@ -161,7 +161,7 @@ router bgp <asn>
|
||||
bgp attribute-download
|
||||
```
|
||||
|
||||
To enable Netflow on an interface, use the following snippet:
|
||||
To enable NetFlow on an interface, use the following snippet:
|
||||
|
||||
```cisco
|
||||
interface Bundle-Ether4000
|
||||
@@ -171,7 +171,7 @@ interface Bundle-Ether4000
|
||||
```
|
||||
|
||||
Also check the [troubleshooting section](05-troubleshooting.md) on how
|
||||
to scale Netflow on the NCS 5500.
|
||||
to scale NetFlow on the NCS 5500.
|
||||
|
||||
Then, SNMP needs to be enabled:
|
||||
|
||||
@@ -202,9 +202,9 @@ router bgp 65400
|
||||
|
||||
### Juniper
|
||||
|
||||
#### Netflow
|
||||
#### NetFlow
|
||||
|
||||
For MX and SRX devices, you can use Netflow v9 to export flows.
|
||||
For MX and SRX devices, you can use NetFlow v9 to export flows.
|
||||
|
||||
```junos
|
||||
groups {
|
||||
|
||||
@@ -69,7 +69,7 @@ $ curl -s http://127.0.0.1:8080/api/v0/inlet/metrics | grep 'akvorado_.*_error'
|
||||
|
||||
### Inlet service
|
||||
|
||||
The inlet service receives Netflow/IPFIX/sFlow packets and forwards them to
|
||||
The inlet service receives NetFlow/IPFIX/sFlow packets and forwards them to
|
||||
Kafka. First, check if you receive packets from exporters (your routers):
|
||||
|
||||
```console
|
||||
@@ -338,7 +338,7 @@ can detect this situation, and you can solve it by reducing the exporter rate.
|
||||
|
||||
#### NCS5500 routers
|
||||
|
||||
[Netflow, Sampling-Interval and the Mythical Internet Packet Size][1] contains
|
||||
[NetFlow, Sampling-Interval and the Mythical Internet Packet Size][1] contains
|
||||
many information about the limit of this platform. The first bottleneck is a 133
|
||||
Mbps shaper between an NPU and the LC CPU for the sampled packets (144 bytes
|
||||
each). For example, on a NC55-36X100G line card, there are 6 NPU, each one
|
||||
|
||||
@@ -125,7 +125,7 @@ tarball". This new tarball does not upgrade the configuration files, nor the
|
||||
- 💥 *console*: persist metadata cache on the default `docker compose` setup
|
||||
- 🩹 *orchestrator*: fix population of `DstNetSite` and `SrcNetSite`
|
||||
- 🩹 *orchestrator*: remove previous networks.csv temporary files on start
|
||||
- 🌱 *inlet*: add support Netflow V5
|
||||
- 🌱 *inlet*: add support NetFlow V5
|
||||
- 🌱 *console*: add support for PostgreSQL and MySQL to store filters
|
||||
- 🌱 *console*: add `console`→`homepage-graph-timerange` to define the time range for the homepage graph
|
||||
- 🌱 *console*: enable round-robin for ClickHouse connections
|
||||
@@ -183,7 +183,7 @@ can install the `docker-compose-v2` package. For other options, check the
|
||||
- ✨ *inlet*: static metadata provider can fetch its configuration from an HTTP endpoint
|
||||
- ✨ *inlet*: metadata can be fetched from multiple providers (eg, static, then SNMP)
|
||||
- ✨ *inlet*: add support for several SNMPv2 communities
|
||||
- ✨ *inlet*: timestamps for Netflow/IPFIX can now be retrieved from packet content, see `inlet`→`flow`→`inputs`→`timestamp-source`
|
||||
- ✨ *inlet*: timestamps for NetFlow/IPFIX can now be retrieved from packet content, see `inlet`→`flow`→`inputs`→`timestamp-source`
|
||||
- 🩹 *cmd*: fix parsing of `inlet`→`metadata`→`provider`→`ports`
|
||||
- 🩹 *console*: fix use of `InIfBoundary` and `OutIfBoundary` as dimensions
|
||||
- 🌱 *orchestrator*: add TLS support to connect to ClickHouse database
|
||||
@@ -247,8 +247,8 @@ can install the `docker-compose-v2` package. For other options, check the
|
||||
- ✨ *orchestrator*: add custom dictionaries for additional flow hydration. See
|
||||
`orchestrator`→`schema`→`custom-dictionaries`. Currently, filtering on the
|
||||
generated data is not available.
|
||||
- 🩹 *inlet*: fix Netflow processing when template is received with data
|
||||
- 🩹 *inlet*: use sampling rate in Netflow data packet if available
|
||||
- 🩹 *inlet*: fix NetFlow processing when template is received with data
|
||||
- 🩹 *inlet*: use sampling rate in NetFlow data packet if available
|
||||
- 🩹 *console*: fix display when using “%” units and interface speed is 0
|
||||
- 🩹 *orchestrator*: create flows table with
|
||||
`allow_suspicious_low_cardinality_types` to ensure we can use
|
||||
|
||||
Reference in New Issue
Block a user