{"id":317,"date":"2010-11-10T03:39:40","date_gmt":"2010-11-10T00:39:40","guid":{"rendered":"http:\/\/www.891rpm.arthead.ru\/?p=317"},"modified":"2017-12-21T13:21:54","modified_gmt":"2017-12-21T10:21:54","slug":"2-gbitsec-span-cisco-export-netflow","status":"publish","type":"post","link":"https:\/\/891rpm.com\/?p=317","title":{"rendered":"2 gbit\/sec SPAN Cisco export Netflow :)"},"content":{"rendered":"<p>\u0412\u0441\u0442\u0430\u043b\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043f\u0438\u0441\u0430\u0442\u044c \u0432\u0435\u0441\u044c \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0441 Cisco 6504, \u043c\u0435\u043d\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0442 2 \u0433\u0438\u0433\u0430\u0431\u0438\u0442\u043d\u044b\u0445 \u043a\u0430\u043d\u0430\u043b\u0430 \u043d\u0430 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430\u0445 Gi2\/1 , Gi2\/2. \u041c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u043f\u0438\u0441\u0430\u0442\u044c NetFlow \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0441 Cisco 6504, \u043d\u043e \u043d\u0430 \u043d\u0435\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0440\u0435\u0437\u043a\u0430 \u043f\u043e\u043b\u043e\u0441 (User Based Rate Limit microflow policy) \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u044d\u043a\u0441\u043f\u043e\u0440\u0442 \u0432 NetFlow \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0431\u0443\u0434\u0435\u043c \u0438\u0437\u0432\u0440\u0430\u0449\u0430\u0442\u044c\u0441\u044f :).<\/p>\n<p>\u0414\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u044b\u0433\u043e\u043d\u0438\u043c SPAN (\u043a\u043e\u043f\u0438\u044e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0449\u0435\u0433\u043e \u043c\u0435\u043d\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0441 Gi2\/1 , Gi2\/2 ) \u0432 \u0434\u0432\u0430 \u0433\u0438\u0433\u0430\u0431\u0438\u0442\u043d\u044b\u0445 \u043f\u043e\u0440\u0442\u0430 Gi2\/4 \u0438 Gi2\/5.<\/p>\n<p><code><br \/>\n!<br \/>\nvlan 100<br \/>\n!<br \/>\n!<br \/>\ninterface Port-channel100<br \/>\nswitchport<br \/>\nswitchport access vlan 100<br \/>\nswitchport mode access<br \/>\n!<br \/>\ninterface GigabitEthernet2\/4<br \/>\nswitchport<br \/>\nswitchport access vlan 100<br \/>\nswitchport mode access<br \/>\nchannel-group 100 mode on<br \/>\n!<br \/>\ninterface GigabitEthernet2\/5<br \/>\nswitchport<br \/>\nswitchport access vlan 100<br \/>\nswitchport mode access<br \/>\nchannel-group 100 mode on<br \/>\n!<br \/>\nmonitor session 1 source interface Gi2\/1 , Gi2\/2<br \/>\nmonitor session 1 destination interface Po100<br \/>\n!<br \/>\n<\/code><\/p>\n<p>\u0422\u0435\u043f\u0435\u0440\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u043c \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043c\u044b \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u043c\u0441\u044f \u00ab\u043b\u043e\u0432\u0438\u0442\u044c\u00bb \u043f\u043e\u0442\u043e\u043a \u0438 \u043e\u0442\u0434\u0430\u0432\u0430\u0442\u044c \u0435\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 NetFlow.<\/p>\n<p>\u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u0432\u044b\u0431\u043e\u0440 \u043d\u0435 \u0432\u0435\u043b\u0438\u043a fprobe, ipcad, softflowd \u0442. \u0435. \u0442\u0435 \u0432\u0435\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0447\u0435\u0440\u0435\u0437 pcap \u00ab\u0443\u043c\u0435\u0440\u043b\u0438\u00bb \u0441\u0440\u0430\u0437\u0443, \u043f\u043e\u043f\u0443\u0442\u043d\u043e \u0443\u0431\u0438\u0432 CPU \u0441\u0435\u0440\u0432\u0435\u0440\u0430 :)<\/p>\n<p>\u0427\u0435\u0440\u0435\u0437 ULOG iptables \u043f\u0438\u0441\u0430\u0442\u044c \u043d\u0435\u043b\u044c\u0437\u044f \u0442. \u043a. \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u043d\u0438 \u0432 \u043e\u0434\u043d\u0443 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 (\u0438\u0431\u043e \u043e\u043d \u043d\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439).<\/p>\n<p>\u041d\u0430\u0448\u0435\u043b\u0441\u044f \u043e\u0434\u0438\u043d \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 (ipt_netflow), \u043d\u043e \u0434\u043b\u044f \u0435\u0433\u043e \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0445\u0435\u043c\u0435 \u0441\u043e Span \u043f\u043e\u0440\u0442\u043e\u043c \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u044f\u0434\u0440\u043e (<a href=\\\"http:\/\/centos.alt.ru\/pub\/kernel\/RHEL\/2.6.18-164.11.1.2\/\\\">\u0437\u0434\u0435\u0441\u044c \u043f\u0430\u0442\u0447\u0435\u043d\u043d\u043e\u0435 \u044f\u0434\u0440\u043e<\/a>) \u0438 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0441\u0430\u043c \u043c\u043e\u0434\u0443\u043b\u044c\u00a0<a href=\\\"http:\/\/centos.alt.ru\/pub\/kmod-netflow\/RHEL\/\\\">ipt_netflow<\/a>\u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0434\u043e ipt_netflow (\u043c\u043e\u0434\u0443\u043b\u044c iptables) \u0438 kmod-netflow-promisc (\u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430).<\/p>\n<p>SPAN \u043f\u043e\u0442\u043e\u043a\u0438 \u043f\u0440\u0438\u0445\u043e\u0434\u044f\u0442 \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0430\u0434\u0430\u043f\u0442\u0435\u0440\u044b eth2 \u0438 eth3 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e.<\/p>\n<p>\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u044d\u0442\u043e\u0433\u043e \u0447\u0443\u0434\u0430 \u043f\u0438\u0448\u0435\u043c \u0432 iptables<\/p>\n<p><code><br \/>\n*raw<br \/>\n-A PREROUTING -i eth2 -j NETFLOW<br \/>\n-A PREROUTING -i eth3 -j NETFLOW<br \/>\nCOMMIT<br \/>\n<\/code><\/p>\n<p>\u0432 \/etc\/modprobe.conf \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c<\/p>\n<p><code><br \/>\noptions ipt_NETFLOW hashsize=160000 destination=\\\"127.0.0.1:2055\\\"<br \/>\n<\/code><\/p>\n<p>\u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0430\u043a\u043e\u0432\u044b, \u0447\u0442\u043e \u043f\u0440\u0438 1-1,5 gbit\/sec \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043c\u044b \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043d\u0430 CPU<br \/>\ntop<br \/>\n<code><br \/>\nTasks: 117 total, 1 running, 116 sleeping, 0 stopped, 0 zombie<br \/>\nCpu0 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st<br \/>\nCpu1 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st<br \/>\nCpu2 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st<br \/>\nCpu3 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st<br \/>\nCpu4 : 0.0%us, 0.0%sy, 0.0%ni, 71.3%id, 0.3%wa, 0.0%hi, 28.3%si, 0.0%st<br \/>\nCpu5 : 0.0%us, 0.0%sy, 0.0%ni, 69.5%id, 0.0%wa, 0.7%hi, 29.8%si, 0.0%st<br \/>\nCpu6 : 0.0%us, 0.0%sy, 0.0%ni, 71.2%id, 0.0%wa, 0.3%hi, 28.4%si, 0.0%st<br \/>\nCpu7 : 0.0%us, 1.0%sy, 0.0%ni, 68.2%id, 0.0%wa, 0.3%hi, 30.4%si, 0.0%st<br \/>\nMem: 4044184k total, 2566136k used, 1478048k free, 485276k buffers<br \/>\nSwap: 2031608k total, 132k used, 2031476k free, 1622060k cached<\/code><\/p>\n<p><code>PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND<br \/>\n33 root 10 -5 0 0 0 S 2.7 0.0 32:41.04 events\/7<br \/>\n1 root 15 0 10348 632 540 S 0.0 0.0 0:02.31 init<br \/>\n2 root RT -5 0 0 0 S 0.0 0.0 0:00.02 migration\/0<br \/>\n3 root 34 19 0 0 0 S 0.0 0.0 0:03.06 ksoftirqd\/0<br \/>\n4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog\/0<br \/>\n5 root RT -5 0 0 0 S 0.0 0.0 0:00.07 migration\/1<br \/>\n6 root 34 19 0 0 0 S 0.0 0.0 0:00.04 ksoftirqd\/1<br \/>\n7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog\/1<br \/>\n8 root RT -5 0 0 0 S 0.0 0.0 0:00.01 migration\/2<br \/>\n9 root 34 19 0 0 0 S 0.0 0.0 0:00.03 ksoftirqd\/2<br \/>\n<\/code><\/p>\n<p>cat \/proc\/net\/stat\/ipt_netflow<br \/>\n<code><br \/>\nFlows: active 354747 (peak 540458 reached 0d16h37m ago), mem 30486K<br \/>\nHash: size 160000 (mem 1250K), metric 2.7, 2.2, 1.0, 1.0. MemTraf: 121088697 pkt, 75450911 K (pdu 5, 276).<br \/>\nTimeout: active 1800, inactive 15. Maxflows 2000000<br \/>\nRate: 1382824352 bits\/sec, 298823 packets\/sec; Avg 1 min: 1367908158 bps, 296724 pps; 5 min: 1361329134 bps, 296061 pps<br \/>\ncpu# stat:\u00a0, sock:\u00a0, traffic:\u00a0, drop:\u00a0Total stat: 38000468809 22085636328 1231067128, 0 0 0 0, sock: 41023746 0 0, 58651136 K, traffic: 23316703456, 13030478 MB, drop: 0, 0 K<br \/>\ncpu0 stat: 0 0 0, 0 0 0 0, sock: 0 0 0, 0 K, traffic: 0, 0 MB, drop: 0, 0 K<br \/>\ncpu1 stat: 0 0 0, 0 0 0 0, sock: 0 0 0, 0 K, traffic: 0, 0 MB, drop: 0, 0 K<br \/>\ncpu2 stat: 0 0 0, 0 0 0 0, sock: 0 0 0, 0 K, traffic: 0, 0 MB, drop: 0, 0 K<br \/>\ncpu3 stat: 0 0 0, 0 0 0 0, sock: 0 0 0, 0 K, traffic: 0, 0 MB, drop: 0, 0 K<br \/>\ncpu4 stat: 9502008868 5521585976 307793882, 0 0 0 0, sock: 0 0 0, 0 K, traffic: 5829379858, 3259408 MB, drop: 0, 0 K<br \/>\ncpu5 stat: 9495159604 5519723902 307727275, 0 0 0 0, sock: 0 0 0, 0 K, traffic: 5827451177, 3255443 MB, drop: 0, 0 K<br \/>\ncpu6 stat: 9500201467 5522411578 307754983, 0 0 0 0, sock: 0 0 0, 0 K, traffic: 5830166561, 3258689 MB, drop: 0, 0 K<br \/>\ncpu7 stat: 9503098870 5521914872 307790988, 0 0 0 0, sock: 41023746 0 0, 58651136 K, traffic: 5829705860, 3256938 MB, drop: 0, 0 K<br \/>\nsock0: 127.0.0.1:2055, sndbuf 33554432, filled 0, peak 140936; err: sndbuf reached 0, other 0<br \/>\n<\/code><\/p>\n<p>\u043a\u0430\u043a \u0432\u0438\u0434\u0438\u043c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0440\u044f\u0434\u043a\u0430 1.3 \u0433\u0431\u0438\u0442\/\u0441\u0435\u043a, 300 kpps :)<\/p>\n<p>\u0412\u0440\u043e\u0434\u0435 \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u0430\u0431\u044b\u043b.<\/p>\n<p><a href=\\\"http:\/\/centos.alt.ru\/?p=367\\\">http:\/\/centos.alt.ru\/?p=367<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0412\u0441\u0442\u0430\u043b\u0430 \u0437\u0430\u0434\u0430\u0447\u0430 \u043f\u0438\u0441\u0430\u0442\u044c \u0432\u0435\u0441\u044c \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0441 Cisco 6504, \u043c\u0435\u043d\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0442 2 \u0433\u0438\u0433\u0430\u0431\u0438\u0442\u043d\u044b\u0445 \u043a\u0430\u043d\u0430\u043b\u0430 \u043d\u0430 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430\u0445 Gi2\/1 , Gi2\/2. \u041c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0431\u044b \u043f\u0438\u0441\u0430\u0442\u044c NetFlow \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0441 Cisco 6504, \u043d\u043e \u043d\u0430 \u043d\u0435\u0439 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0440\u0435\u0437\u043a\u0430 \u043f\u043e\u043b\u043e\u0441 (User Based Rate Limit microflow policy) \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u044d\u043a\u0441\u043f\u043e\u0440\u0442 \u0432 NetFlow \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0431\u0443\u0434\u0435\u043c \u0438\u0437\u0432\u0440\u0430\u0449\u0430\u0442\u044c\u0441\u044f :). \u0414\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u044b\u0433\u043e\u043d\u0438\u043c [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[89,350,495],"class_list":["post-317","post","type-post","status-publish","format-standard","hentry","category-tech-articles","tag-cisco","tag-netflow","tag-span"],"_links":{"self":[{"href":"https:\/\/891rpm.com\/index.php?rest_route=\/wp\/v2\/posts\/317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/891rpm.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/891rpm.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/891rpm.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/891rpm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=317"}],"version-history":[{"count":0,"href":"https:\/\/891rpm.com\/index.php?rest_route=\/wp\/v2\/posts\/317\/revisions"}],"wp:attachment":[{"href":"https:\/\/891rpm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/891rpm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/891rpm.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}