1

I have Netflow V9 being sent to a server running Ubuntu 14.04. The data is communicated on port 2000 (the default for Netflow). However nothing appears to be listening on that port. (nothing shows port 2000 when I run 'netstat -ntlp'.

I have a few rather-noobish questions:

What service should I configure to listen on port 2000?
Where can I find this raw data? Is it by default being written to a file?

The point of my project is to fan out the netflow data, with some of it being downsampled prior to being forwarded. Our Cisco Nexus can fan out and downsample, but my understanding is the Nexus 7000 can't fan out and downsample just one exporter, it's an all-or-none as far as downsampling goes.

If I can provide any additional info, please let me know. Thanks for any and all help.

Improve this question
1
  • 1
    You'll need to install some software which can collect the netflow data on your machine. There are several good open source netflow collectors available on linux, but unfortunately software recommendations are off topic here. Those can be asked on softwarerecs.stackexchange.com
    – Teun Vink ♦
    Jun 22, 2016 at 20:50

1 Answer 1

Reset to default
2

You can send as much netflow traffic to a host as you like. Without some software listening on the host you wont collect any data.

There are several options to choose from, my Debian box here comes with nfdump, pmacct, ntopng ant probably several others. There are many more options from a free and open source to very expensive commercial software. Where the data is stored depends on the software you use.

In the past I found a combination of nfdump and nfsen (web interface for nfdump) quite useful.

Improve this answer
1
  • Thanks @Jens, I have a much more solid understanding of Netflow transport now. I'm using NFCapd with NFDump as all I really need is to write netflow data to a file that I tail with my ELK stack.
    – SethYes
    Jul 15, 2016 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.