{"id":1097,"date":"2014-11-09T15:58:06","date_gmt":"2014-11-09T14:58:06","guid":{"rendered":"http:\/\/diablo.craem.net\/?p=1097"},"modified":"2014-11-09T15:58:06","modified_gmt":"2014-11-09T14:58:06","slug":"netflow-nfsen-nfdump-en-debian-3-cacti-pmacct","status":"publish","type":"post","link":"https:\/\/diablo.craem.net\/?p=1097","title":{"rendered":"Netflow: nfsen + nfdump en Debian (3) + cacti + pmacct"},"content":{"rendered":"

Ahora vamos a a\u00f1adir una capa m\u00e1s…. pmacct.
\nPmacct ser\u00e1 el enlace entre cacti y los flows de los dispositivos… usaremos nfsen para controlar tr\u00e1fico y ataques.
\nDescargamos y descomprimimos pmacct:
\n
\n# cd \/usr\/src
\n# wget -c https:\/\/www.pmacct.net\/pmacct-1.5.0.tar.gz
\n# tar -zxvf pmacct-1.5.0.tar.gz
\n<\/code>
\nCreamos el directorio de instalaci\u00f3n:
\n
\n# mkdir \/etc\/pmacct
\n<\/code>
\nY instalamos
\n
\nUna vez instalado, vamos a configurar lo que nos interesa de pmacct, que m\u00e1s tarde, enlazaremos con cacti.
\n
\n# nano \/etc\/pmacct.conf
\ndebug: true
\ndaemonize: true
\nnfacctd_port: 9996
\npidfile: \/var\/run\/nfacctd.pid
\nplugin_buffer_size: 80524
\nplugin_pipe_size: 18052324
\nnetworks_file: \/etc\/pmacct\/nfacctd.hosts
\nplugins: memory[in], memory[out]
\naggregate[in]: dst_host
\naggregate[out]: src_host
\nimt_path[in]: \/tmp\/in.pipe
\nimt_path[out]: \/tmp\/out.pipe
\n<\/code>
\nEn el fichero nfacctd.hosts, a\u00f1adimos las ip’s \/ rangos que nos interese tener en detalle…
\n
\n# nano \/etc\/pmacct\/nfacctd.hosts
\n1.1.1.1\/32
\n1.1.1.2\/32
\n..
\n...
\n<\/code>
\nLanzamos pmacct….
\n
\nroot@testflow:\/etc\/pmacct\/sbin# .\/nfacctd -D -f \/etc\/pmacct\/pmacct.conf
\n<\/code>
\nPara comprobar que estamos escuchando correctamente:
\n
\nroot@testflow:\/etc\/pmacct\/bin# netstat -putan | grep 9996
\nudp 0 0 0.0.0.0:9996 0.0.0.0:* 17799\/nfacctd: Core
\n<\/code>
\ny que recogemos flows:
\n
\nroot@testflow:\/etc\/pmacct\/bin# .\/pmacct -s -p \/tmp\/out.pipe
\nroot@testflow:\/etc\/pmacct\/bin# .\/pmacct -s -p \/tmp\/in.pipe
\n<\/code>
\nY ahora comprobamos si hace accounting de las ip’s en concreto:
\n
\nroot@testflow:\/etc\/pmacct\/bin# .\/pmacct -c dst_net -N 1.1.1.1 -p \/tmp\/in.pipe
\n7254628
\nroot@testflow:\/etc\/pmacct\/bin# <\/code>
\nY vemos c\u00f3mo ya nos muestra tr\u00e1fico en bytes \ud83d\ude42
\n\"Captura<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Ahora vamos a a\u00f1adir una capa m\u00e1s…. pmacct. Pmacct ser\u00e1 el enlace entre cacti y los flows de los dispositivos… usaremos nfsen para controlar tr\u00e1fico y ataques. Descargamos y descomprimimos pmacct: # cd \/usr\/src # wget -c https:\/\/www.pmacct.net\/pmacct-1.5.0.tar.gz # tar -zxvf pmacct-1.5.0.tar.gz Creamos el directorio de instalaci\u00f3n: # mkdir \/etc\/pmacct Y instalamos<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,1],"tags":[38,121,125,142],"class_list":["post-1097","post","type-post","status-publish","format-standard","hentry","category-linux","category-sin-categoria","tag-cacti","tag-netflow","tag-nfsen","tag-pmacct"],"_links":{"self":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/1097","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1097"}],"version-history":[{"count":0,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/1097\/revisions"}],"wp:attachment":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}