On Sun, Dec 6, 2009 at 4:39 PM, Joseph L. Casale
<JCasale at activenetwerx.com> wrote:> Anyone got a reco on a package that can collect netflow data and accept
user defined queries
> for specific data, like what an ip did every hour for some said interval?
well, collecting is pretty easy of course - tcpdump.
And you can load the files into wireshark to query.
Though it is probably not just what you want.
In my old job I set up a sniffer appliance which basically ran
tcpdump on any interface except the main interface, and logged it all
in circular log files of a certain size. And the directory where
these were kept were served out via the web server so that anyone
could surf to the box and grab log files to look at.
You may also want to have a look at what ntop can do these days - it
has been a few years since i've looked at it.
But of course this all assumes the traffic is visible to your CentOS
box. For my sniffer appliance the way to deploy it was that all the
other NICs except the main one got plugged into a mirror port on the
switch, which mirrored the particular PC we wanted to sniff. In our
case this was fine because we only monitored our product which was a
VOIP appliance we were developing.
Alternately, running this on your router will pick up most of what you
want - but obviously not local LAN traffic
--
?Don't eat anything you've ever seen advertised on TV?
- Michael Pollan, author of "In Defense of Food"