https://www.nico-maas.de/tags/fprobe/ Recent content in Fprobe on Nico Maas Hugo -- gohugo.io en-us Mon, 26 Oct 2015 12:18:37 +0000 https://www.nico-maas.de/posts/2015-10-26-netflow-on-ubuntu/ Mon, 26 Oct 2015 12:18:37 +0000 https://www.nico-maas.de/posts/2015-10-26-netflow-on-ubuntu/ <p>Netflow consists of three parts:</p> <ul> <li>The collector, which collects the connection data on a host</li> <li>the capture, which receives data from collectors and writes them to disk in binary format</li> <li>the dump tool, which presents the data</li> </ul> <p>We use fprobe as collector and nfcapd as capture tool:</p> <pre tabindex="0"><code>sudo apt-get install fprobe nfdump </code></pre><p>fprobe wants to be configured during the installation. It asks for the interface which should be listend upon and where the flow collector does listen. In our example, eth0 should be listend upon and the flow collector is situated on the same computer. Please use 127.0.0.1:9995 for that.</p>