ipt_netflow-1.6 - Netflow Based Monitoring Solution for Linux and iptables

After several days of investigation for the right solution for the network monitoring needs of my small company, I found a very powerful tool that helped me solve the problem and today I want to share it with you. Its name is ipt_netflow and it is an iptables module that can be used to understand what's going on in your network.

The company was needing "Eyes" on the network infrastructure, mainly on its firewalls to see what was going trough them and to understand the flow of the information inside of the corporate structure. Because it is a small company , we are using open source software everywhere including iptables for the firewalls and it made sense, then, to use open source software for the monitoring solution as well.

I have created an installation guide for ipt_netflow-1.6 under CentOS 5.4 that I would like to share with those interested on this subject and here it goes...Next post will be covering the same installation under Ubuntu 9.10.

First we will need to make sure our system complies with some basic packages needed to compile the ipt_netflow module.

Under CentOS 5.4 , and as root, install:

yum install iptables-devel.i386
yum install gcc.i386
yum install kernel-devel.i686
yum install kernel.i686
yum install gcc gcc-c++ kernel-devel

Then download ipt_netflow from:

http://sourceforge.net/projects/ipt-netflow/files/ipt-netflow/1.6/ipt_netflow-1.6.tgz/download

or execute the following command on your Linux box:

wget http://downloads.sourceforge.net/project/ipt-netflow/ipt-netflow/1.6/ipt_netflow-1.6.tgz

Unpack ipt_netflow-1.6.tgz:

tar -xzvf ipt_netflow-1.6.tgz

Move into the ipt_netflow folder :

cd ipt_netflow-1.6.tgz

Because CentOS normally goes a little behind with its package selection we need to edit one of the files provided within the ipt_netflow-1.6.tgz for this to work under CentOS 5.4. So let's edit the libipt_NETFLOW.c file:

vi libipt_NETFLOW.c

Search for "void _init(void)" and Replace the line:

void _init(void)

For the following line:

void __attribute((constructor)) my_init(void)

After this, save changes and exit.

Now we are ready to compile the module so execute:

./configure

and if it returns no errors then execute:

make all install; depmod

If the compilation returns no errors then the installation is done and now you need to load the module and setup the corresponding iptables rules.

First copy the ipt_NETFLOW.ko (wherever it was placed on your system) into the kernel modules folder (if the right kernel was installed it should be there already and this step is not needed):

cp /lib/modules/2.6.18-164.11.1.el5.centos.plus/extra/ipt_NETFLOW.ko /lib/modules/2.6.18-164.11.1.el5/extra/

Second load the module using modprobe:

modprobe ipt_NETFLOW destination=netflowserverip:port

Third add rules to the iptables at the top of the list:

iptables -A INPUT -j NETFLOW
iptables -A OUTPUT -j NETFLOW
iptables -A FORWARD -j NETFLOW


Now you only need to restart iptables for the flows to start being exported to your netflow server. In my case I'm using ManageEngine Netflow Analizer Free Edition which allows me to monitor a maximum of to interfaces for free. I strongly recommend you use the same application for this purpose since it is unbelievably good.

Before finishing the setup we need to tune up a little bit the ipt_netflow module. For this I like to set up the active_timeout to 10 because it is 1800 by default and this cause a delay in the flow reporting. To do this execute:

sysctl -w net.netflow.active_timeout=10

or if you want to make this permanent you would like to edit the /etc/sysctl.conf file and add this line to it:

net.netflow.active_timeout=10

It is also a good idea to load the ipt_netflow module automatically every time you restart your Linux box, for this you need to add the following line to the /etc/rc.local file:

modprobe ipt_NETFLOW destination=netflowserverip:port

and, of course, change the "netflowserverip:port" for the corresponding Server IP Address and Port.

You can take a look at some of the stats by issuing the following command in your Linux box:

cat /proc/net/stat/ipt_netflow

and you can also use tcpdump to check if the flows are being exported properly.

You will also need to add an extra rule to you iptables rule set, that allows the flows to get out of the Linux box and go to the Netflow Server. Something like the following line, but of course, changing the Interface, IP and Port shown, for the ones corresponding with your infrastructure:

iptables -A OUTPUT -o eth0 -p udp -d 192.168.0.70 --dport 9996 -j ACCEPT

Please let me know if you run into some problem while following this guide. I will be more than pleased to help any of you out there.

Enjoy.

P.D. - There is also an RPM for this but I couldn't make it work properly (http://centos.alt.ru/?p=306). Please let me know if anyone have made this work.

Here you are a couple of interesting links regarding ipt_netflow-1.6 module:

http://centos.alt.ru/?s=ipt_netflow