%include "default.mgp"
%tab bullet icon arc "blue" 40
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%nodefault
%bgrad 0 0 32 0 1 "cyan" "magenta"
%xfont "utopia-bold-r", size 12

%center, fore "black"
cflowd 2.0 configuration
%size 5
%xfont "courier-bold-r"





dwm@caida.org

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"
%center

cflowd data flow

%image "dataflow1.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"
%center

cflowd architecture

%image "dataflow2.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"
%center

cflowd processes

%image "processes.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

cflowd[mux] configuration file

%xfont "utopia-bold-r", fore "black", size 5
&bullet configuration file is shared by cflowdmux and cflowd
&bullet normally named cflowd.conf

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

cflowd.conf OPTIONS stanza

%xfont "utopia-bold-r", fore "black", size 5
&bullet LOGFACILITY - syslog facility
&bullet TCPCOLLECTPORT - port to listen for cfdcollect
&bullet PKTBUFSIZE - shared memory packet queue size
&bullet TABLESOCKFILE - named socket to listen for local clients
&bullet FLOWDIR - raw flow file directory
&bullet FLOWFILELEN - length of flow files
&bullet NUMFLOWFILES - number of flow files per router
&bullet MINLOGMISSED - missed flows logging threshold

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

Example OPTIONS stanza

%center

%image "options_stanza.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

cflowd.conf COLLECTOR stanza

%xfont "utopia-bold-r", fore "black", size 5
&bullet controls access from cfdcollect
&bullet more than one may exist
&bullet HOST - IP address of cfdcollect host
&bullet ADDRESSES - list of addresses for cfdcollect host
&bullet AUTH - currently unused

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

Example COLLECTOR stanza

%center

%image "collector_stanza.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

cflowd.conf CISCOEXPORTER stanza

%xfont "utopia-bold-r", fore "black", size 5
&bullet configuration for a Cisco
&bullet one CISCOEXPORTER stanza per router
&bullet HOST - IP address of Cisco
&bullet ADDRESSES - IP addresses of Cisco's interfaces
&bullet CFDATAPORT - port on which to listen for Cisco's flow-export
&bullet LOCALAS - kludge for AS 0 problems
&bullet COLLECT - what to save from the Cisco's flow-export data

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

Example CISCOEXPORTER stanza

%image "ciscoexporter_stanza.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

centralized collection: cfdcollect

%image "centralCollection.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

cfdcollect configuration file

%xfont "utopia-bold-r", fore "black", size 5
&bullet configuration file usually named cfdcollect.conf
&bullet configures communication with instances of cflowd


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

system stanza

%xfont "utopia-bold-r", fore "black", size 5
&bullet logFacility - syslog facility
&bullet dataDirectory - directory in which to store ARTS files
&bullet filePrefix - prefix used to name ARTS files (normally 'arts')
&bullet pidFile - file in which to store process ID

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

example system stanza

%center
%image "system_stanza.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

cflowd stanza

%xfont "utopia-bold-r", fore "black", size 5
&bullet host - cflowd host name
&bullet tcpCollectPort - connect to this port
&bullet minPollInterval - minimum collection interval

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

example cflowd stanza

%center
%image "cflowd_stanza.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

Router configuration

%center
%image "ispconfig1.gif"

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

Collect at edges

%xfont "utopia-bold-r", fore "black", size 5
&bullet best for security-related activities
&bullet netflow is input-based
&bullet reduce quantity of data (don't enable in transit)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%page
%xfont "utopia-bold-r"
%bgrad 0 0 32 0 0 "white" "cyan"
%fore "black"

Configuring flow-export

%xfont "utopia-bold-r", fore "black", size 5
Required in global context:
%xfont "10x20", fore "black", size 3

      ip flow-export destination 1.2.3.4 2055
      ip flow-export version 5 origin-as

%xfont "utopia-bold-r", fore "black", size 5
Optional but recommended in global context:

%xfont "10x20", fore "black", size 3
      ip cef [distributed]
      ip flow-cache active-timeout 5

%xfont "utopia-bold-r", fore "black", size 5
Required in interface context:

%xfont "10x20", fore "black", size 3
      ip route-cache flow


