netflow

NetFlow Version 5 library for Fibjs

install

npm install @fxjs/netflow

Usage

The usage of the netflowv9 collector library is very very simple. You just have to do something like this:

let Collector = require('@fxjs/netflow');

let co = new Collector(3000, function(flow) {
    console.log(flow);
})
co.run((err) => { console.error(err); })

or you can use it as event provider:

let co = new Collector({port: 3000}).on('data',function(flow) {
    console.log(flow);
});
co.run()

The flow will be presented in a format very similar to this:

{ header:
  { version: 9,
     count: 25,
     uptime: 2452864139,
     seconds: 1401951592,
     sequence: 254138992,
     sourceId: 2081 },
  rinfo:
  { address: '15.21.21.13',
     family: 'IPv4',
     port: 29471,
     size: 1452 },
  packet: Buffer <00 00 00 00 ....>
  flow: [
  { in_pkts: 3,
     in_bytes: 144,
     ipv4_src_addr: '15.23.23.37',
     ipv4_dst_addr: '16.16.19.165',
     input_snmp: 27,
     output_snmp: 16,
     last_switched: 2452753808,
     first_switched: 2452744429,
     l4_src_port: 61538,
     l4_dst_port: 62348,
     out_as: 0,
     in_as: 0,
     bgp_ipv4_next_hop: '16.16.1.1',
     src_mask: 32,
     dst_mask: 24,
     protocol: 17,
     tcp_flags: 0,
     src_tos: 0,
     direction: 1,
     fw_status: 64,
     flow_sampler_id: 2 } } ]

There will be one callback for each packet, which may contain more than one flow.

Additionally, you can use the collector to listen for template updates:

var collector = new Collector({port: 3000});
collector.on('data', function(data) {
    console.log(data);
});
collector.run()

Currently we support netflow version 5.

Options

You can initialize the collector with either callback function only or a group of options within an object.

The following options are available during initialization:

port - defines the port where our collector will listen to.

new Collector({ port: 5000, cb: function (flow) { console.log(flow) } })

Or

new Collector(5000, function (flow) { console.log(flow) })

host - binds to a particular host on the local interfaces.

new Collector({ port: 5000, host: '0.0.0.0', cb: function (flow) { console.log(flow) } })

type - defines to what socket type we will bind to. Default is udp4. You can change it to udp6 is you like.

new Collector(5000, { socketType: 'udp6', cb: function (flow) { console.log(flow) } })

recvBufferSize - defines the udp socket recvBuffer default 256kbytes.

Multiple collectors

The module allows you to define multiple collectors at the same time. For example:

var Collector = require('@fxjs/netflow');

new Collector(5555, function(flow) { // Collector 1 listening on port 5555
    console.log(flow);
}).run();

new Collector(6666, function(flow) { // Collector 2 listening on port 6666
    console.log(flow);
}).run();