vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

flow-accounting: break after 80 characters

Browse Source
This commit is contained in:
Christian Poessinger 2019-12-28 19:33:12 +01:00
parent b020164f7e
commit 49879dfc0c
1 changed files with 26 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
docs/system/flow-accounting.rst
View File

@ -4,11 +4,12 @@
Flow Accounting Flow Accounting
############### ###############
VyOS supports flow-accounting for both IPv4 and IPv6 traffic. The system acts as a VyOS supports flow-accounting for both IPv4 and IPv6 traffic. The system acts
flow exporter, and you are free to use it with any compatible collector. as a flow exporter, and you are free to use it with any compatible collector.
Flows can be exported via two different protocols: NetFlow (versions 5, 9 and 10/IPFIX) Flows can be exported via two different protocols: NetFlow (versions 5, 9 and
and sFlow. Additionally, you may save flows to an in-memory table internally in a router. 10/IPFIX) and sFlow. Additionally, you may save flows to an in-memory table
internally in a router.
.. warning:: You need to disable the in-memory table in production environments! .. warning:: You need to disable the in-memory table in production environments!
Using :abbr:`IMT (In-Memory Table)` may lead to heavy CPU overloading and Using :abbr:`IMT (In-Memory Table)` may lead to heavy CPU overloading and
@ -31,8 +32,8 @@ NetFlow) consists of three main components:
* **application**: analyzes received flow data in the context of intrusion * **application**: analyzes received flow data in the context of intrusion
detection or traffic profiling, for example detection or traffic profiling, for example
For connectionless protocols as like ICMP and UDP, a flow is considered complete For connectionless protocols as like ICMP and UDP, a flow is considered
once no more packets for this flow appear after configurable timeout. complete once no more packets for this flow appear after configurable timeout.
NetFlow is usually enabled on a per-interface basis to limit load on the router NetFlow is usually enabled on a per-interface basis to limit load on the router
components involved in NetFlow, or to limit the amount of NetFlow records components involved in NetFlow, or to limit the amount of NetFlow records
@ -52,19 +53,20 @@ interface, the interface must be configured for flow accounting.
You can configure multiple interfaces which whould participate in flow You can configure multiple interfaces which whould participate in flow
accounting. accounting.
.. note:: Will be recorded only packets/flows on **incoming** directinon .. note:: Will be recorded only packets/flows on **incoming** direction in
in configured interfaces. configured interfaces.
By default, recorded flows will be saved internally and can be listed with the CLI By default, recorded flows will be saved internally and can be listed with the
command. You may disable using the local in-memory table with the command: CLI command. You may disable using the local in-memory table with the command:
.. cfgcmd:: set system flow-accounting disable-imt .. cfgcmd:: set system flow-accounting disable-imt
Internally, in flow-accounting processes exist a buffer for data exchanging between Internally, in flow-accounting processes exist a buffer for data exchanging
core process and plugins (each export target is a separated plugin). If you have high between core process and plugins (each export target is a separated plugin). If
traffic levels or noted some problems with missed records or stopping exporting, you you have high traffic levels or noted some problems with missed records or
may try to increase a default buffer size (10 MiB) with the next command: stopping exporting, you may try to increase a default buffer size (10 MiB) with
the next command:
.. cfgcmd:: set system flow-accounting buffer-size '<buffer size>' .. cfgcmd:: set system flow-accounting buffer-size '<buffer size>'
@ -123,12 +125,13 @@ NetFlow
Specifies the interval at which Netflow data will be sent to a collector. As Specifies the interval at which Netflow data will be sent to a collector. As
per default, Netflow data will be sent every 60 seconds. per default, Netflow data will be sent every 60 seconds.
You may also additionally configure timeouts for different types of connections. You may also additionally configure timeouts for different types of
connections.
.. cfgcmd:: set system flow-accounting netflow max-flows '<number>' .. cfgcmd:: set system flow-accounting netflow max-flows '<number>'
If you want to change the maximum number of flows, which are tracking simultaneously, If you want to change the maximum number of flows, which are tracking
you may do this with this command (default 8192). simultaneously, you may do this with this command (default 8192).
sFlow sFlow
^^^^^ ^^^^^
@ -144,9 +147,9 @@ sFlow
.. cfgcmd:: set system flow-accounting sflow agent-address '<address>' .. cfgcmd:: set system flow-accounting sflow agent-address '<address>'
Configure a sFlow agent address. It can be IPv4 or IPv6 address, but you must set Configure a sFlow agent address. It can be IPv4 or IPv6 address, but you
the same protocol, which is used for sFlow collector addresses. must set the same protocol, which is used for sFlow collector addresses. By
By default, using router-id from BGP or OSPF protocol, or the primary IP default, using router-id from BGP or OSPF protocol, or the primary IP
address from the first interface. address from the first interface.
Example: Example:
@ -183,8 +186,6 @@ display captured network traffic information for all configured interfaces.
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40006 22 tcp 16 146 1 9444 eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40006 22 tcp 16 146 1 9444
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 0 0 icmp 192 27 1 4455 eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 0 0 icmp 192 27 1 4455
.. opcmd:: show flow-accounting interface '<interface>' host '<address>' .. opcmd:: show flow-accounting interface '<interface>' host '<address>'
Show flow accounting information for given `<interface>` for a specific host Show flow accounting information for given `<interface>` for a specific host