ABOUT

YS APPLE
CHECKPOINT-NGNGX
CISCO
FORTIGATE
FORTINET
LINUX
REVERSING
ARCHIVES
TAGS
RSS

Nfdump netflow/sflow cookbook of examples

Sun 20 September 2020 in Linux #Fortigate #Linux

Table of Contents
Introduction
Start nfcapd netflow collector in a daemon mode listening on port 5001 with all extensions enabled
and saving received netflow data into the named folder NFS-cisco-rtr. Accept netflow records only
coming from the sender with the IP of 13.13.13.137
Read and print all records form a single file
Display cumulative statistics about all the flows in a records file
Read and print all records from a range of files, starting at nfcapd.202004221040 and up to but not
including the current file still being written to nfcapd.current.1609
Read all records from a range of files, starting at nfcapd.202209242120 and finishing at
nfcapd.202209242150
Print sessions where the source or destination IP is 8.8.8.8
Print sessions where the destination port is 53, the destination IP is 8.8.8.8, and the protocol is TCP
Show top 10 flows sorted by the bits per second statistics
Show all flows sorted by the bits per second statistics
Aggregate all flows to/from host 8.8.8.8 based on source IP
Calculate statistics for port 443 traffic and sort by bps to see bandwidth abusing hosts
Sort presented flows by duration, longest at the bottom
Anonymize IP addresses in all the flows in the file, overwrite in-place
Find records in the time range of 12:19:00 - 12:20:00 matching the filter of protocol = UDP and port =
53

Introduction
Few facts to know before diving into examples:

nfdump packet filter syntax is tcpdump-compatible, and it should come as the last argument on the
line.

nfcapd daemon receives Netflow streams and saves them into local files, switching to a new file every
5 minutes (configurable). The naming starts with nfcapd, then dot, and finally date and time stamp.

The newest version for 2022 is 1.7, which is multi-threaded.

There is a GUI web based front end nfsen, which is a separate install.

nfdump reads files from filesystem and outputs to either STDOUT or to binary files (if used with -w
option). If it runs out of host memory or free disk space for temporary files, it will crash.

Start nfcapd netflow collector in a daemon mode listening on

port 5001 with all extensions enabled and saving received
netflow data into the named folder NFS-cisco-rtr. Accept netflow
records only coming from the sender with the IP of 13.13.13.137
nfcapd -D -T all -n NFS-cisco-rtr,13.13.13.137,/var/flows/NFS-cisco-rtr -p 5001

Read and print all records form a single file

Here the records file is nfcapd.202004221040 nfdump prints record in random order, not sorted by any
means.

nfdump -r nfcapd.202004221040

Display cumulative statistics about all the flows in a records file

nfdump -I -r nfcapd.202004221040

Output:

Ident: NFS-cisco-rtr
Flows: 378330
Flows_tcp: 318586
Flows_udp: 54743
Flows_icmp: 3864
Flows_other: 1137
Packets: 11162669
Packets_tcp: 8681920
Packets_udp: 2163252
Packets_icmp: 34346
Packets_other: 283151
Bytes: 6315310484
Bytes_tcp: 5677222352
Bytes_udp: 467682299
Bytes_icmp: 3717079
Bytes_other: 166688754
First: 1587551972
Last: 1587552299
msec_first: 950
msec_last: 914
Sequence failures: 0

Read and print all records from a range of files, starting at

nfcapd.202004221040 and up to but not including the current file
still being written to nfcapd.current.1609
nfdump -R nfcapd.202004221040

Read all records from a range of files, starting at

nfcapd.202209242120 and finishing at nfcapd.202209242150
This works if files are in the same directory. If they are not, also specify -M for directories list.

nfdump -R nfcapd.202209242120:nfcapd.202209242150

Print sessions where the source or destination IP is 8.8.8.8

nfdump -r nfcapd.202004221040 'host 8.8.8.8'

Print sessions where the destination port is 53, the destination IP

is 8.8.8.8, and the protocol is TCP
nfdump -r nfcapd.202004221040 'host 8.8.8.8 and dst port 53 and proto tcp '

Show top 10 flows sorted by the bits per second statistics

Note: -o extended sets output to include also bps column. -n 10 limits output to top 10 rows (which is
default as well). Finally, -O bps tells nfdump to sort the output by bits per second value in descending
(default) order.

nfdump -r nfcapd.202004221050 -n 10 -O bps -o extended

Output:

Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Flags To
2020-04-22 12:19:58.824 0.004 TCP 44.30.248.239:443 -> 44.244.6.114:54044 ...AP... 1
2020-04-22 12:22:37.845 0.004 TCP 175.68.86.47:80 -> 44.244.6.114:53717 ...AP... 12
2020-04-22 12:20:37.844 0.004 TCP 175.68.86.47:80 -> 44.244.6.114:53717 ...AP... 12
2020-04-22 12:24:37.845 0.004 TCP 175.68.86.47:80 -> 44.244.6.114:53717 ...AP... 12
2020-04-22 12:22:59.517 0.008 TCP 44.244.195.12:443 -> 44.244.6.114:58302 ...AP... 1
2020-04-22 12:23:15.541 0.036 TCP 44.244.195.12:443 -> 44.244.6.114:58302 ...AP... 1
2020-04-22 12:20:03.728 0.004 TCP 50.62.32.42:80 -> 216.88.40.116:52054 ...AP... 4
2020-04-22 12:23:08.773 0.012 TCP 44.244.195.12:443 -> 44.244.6.114:58302 ...AP... 1
2020-04-22 12:22:58.377 0.004 TCP 50.62.32.25:80 -> 216.88.40.116:52157 ...AP...
2020-04-22 12:21:25.568 0.028 TCP 158.255.172.17:443 -> 44.244.6.114:55324 ...AP... 1
IP addresses anonymised
Summary: total flows: 492540, total bytes: 7.4 G, total packets: 14.6 M, avg bps: 184.8 M, avg pps:
Time window: 2020-04-22 12:19:37 - 2020-04-22 12:24:59
Total flows processed: 492540, Blocks skipped: 0, Bytes read: 39403680
Sys: 0.216s flows/second: 2277989.2 Wall: 0.404s flows/second: 1219146.3

Show all flows sorted by the bits per second statistics

nfdump -r nfcapd.202004221050 -n 0 -O bps -o extended

Aggregate all flows to/from host 8.8.8.8 based on source IP

nfdump -r nfcapd.202004221005 -A srcip ' host 8.8.8.8'

Date first seen Duration Src IP Addr Packets Bytes bps Bpp Flows
2020-04-22 10:05:01.183 241.032 113.166.180.142 122 6938 230 56 122
2020-04-22 10:05:00.915 295.020 18.113.121.204 1493 96860 2626 64 62
2020-04-22 10:05:03.819 289.848 18.113.43.130 750 63000 1738 84 54
2020-04-22 10:05:02.887 289.828 113.166.180.139 750 63000 1738 84 49
2020-04-22 10:05:01.455 295.148 113.166.180.138 812 50458 1367 62 810
2020-04-22 10:05:03.507 289.852 113.166.180.137 750 63000 1738 84 56
2020-04-22 10:04:55.799 300.484 89.12.212.116 417 33261 885 79 417
2020-04-22 10:05:00.667 289.868 113.166.180.141 750 63000 1738 84 55
2020-04-22 10:04:56.047 303.116 8.8.8.8 6730 768784 20290 114 1825
2020-04-22 10:05:01.127 291.740 113.166.88.58 886 70796 1941 79 172
Summary: total flows: 3622, total bytes: 1.3 M, total packets: 13460, avg bps: 33731, avg pps: 44, a
Time window: 2020-04-22 10:04:37 - 2020-04-22 10:09:59
Total flows processed: 426270, Blocks skipped: 0, Bytes read: 34102112
Sys: 0.036s flows/second: 11784203.7 Wall: 0.036s flows/second: 11560177.9

Calculate statistics for port 443 traffic and sort by bps to see
bandwidth abusing hosts
We can include as many -s as needed, each statistics table will be printed independently. Statistics will be
calculated for the flows located in this specific nfcapd. file, to count statistics over longer periods of time
see -R & -M

nfdump -r nfcapd.202004220705 -s srcip/bps -s dstip/bps ' port 443'

Output:

Top 10 Src IP Addr ordered by bps:

Date first seen Duration Proto Src IP Addr Flows(%) Packets(%) Bytes(%)
2020-04-22 12:19:50.336 309.513 any 219.149.22.196 8957( 2.6) 995109(10.7) 1.3 G(21
2020-04-22 12:19:50.336 309.361 any 219.149.22.201 8167( 2.4) 837173( 9.0) 1.1 G(18
2020-04-22 12:19:37.828 322.081 any 44.244.6.114 58555(16.9) 2.1 M(22.3) 978.3 M(16
2020-04-22 12:21:31.120 0.496 any 128.73.82.164 6( 0.0) 958( 0.0) 1.3 M( 0
2020-04-22 12:19:49.064 310.609 any 244.34.184.28 6849( 2.0) 411384( 4.4) 369.3 M( 6
2020-04-22 12:23:01.213 2.244 any 148.161.85.162 3( 0.0) 1322( 0.0) 1.9 M( 0
2020-04-22 12:19:49.860 309.909 any 244.34.184.29 4425( 1.3) 270828( 2.9) 250.0 M( 4
2020-04-22 12:19:52.984 306.313 any 219.149.22.228 12205( 3.5) 245171( 2.6) 244.1 M( 4
2020-04-22 12:21:08.360 6.460 any 92.34.211.23 4( 0.0) 3080( 0.0) 4.5 M( 0
2020-04-22 12:19:37.828 321.421 any 219.149.22.229 16208( 4.7) 252091( 2.7) 220.4 M( 3
 Top 10 Dst IP Addr ordered by bps:
Date first seen Duration Proto Dst IP Addr Flows(%) Packets(%) Bytes(%)
2020-04-22 12:19:37.828 322.081 any 44.244.6.114 57453(16.6) 3.5 M(37.6) 3.1 G(51
2020-04-22 12:19:43.316 316.633 any 216.88.40.117 56198(16.2) 1.1 M(11.8) 939.0 M(15
2020-04-22 12:19:48.900 311.033 any 216.88.40.116 56349(16.3) 1.0 M(11.0) 835.6 M(13
2020-04-22 12:19:54.760 300.929 any 93.161.105.117 833( 0.2) 83367( 0.9) 108.3 M( 1
2020-04-22 12:19:47.736 310.013 any 210.249.165.16 89( 0.0) 79489( 0.9) 92.7 M( 1
2020-04-22 12:19:59.256 298.577 any 70.35.238.51 180( 0.1) 100020( 1.1) 85.8 M( 1
2020-04-22 12:20:07.024 0.004 any 209.213.75.111 2( 0.0) 28( 0.0) 1120( 0
2020-04-22 12:21:16.636 0.004 any 216.88.58.165 2( 0.0) 22( 0.0) 968( 0
2020-04-22 12:19:59.472 299.353 any 207.176.46.233 94( 0.0) 42353( 0.5) 45.7 M( 0
2020-04-22 12:19:50.356 309.537 any 219.149.22.196 9055( 2.6) 274394( 2.9) 47.0 M( 0

IP addresses anonymised
Summary: total flows: 346143, total bytes: 6.1 G, total packets: 9.3 M, avg bps: 151.8 M, avg pps: 2
Time window: 2020-04-22 12:19:37 - 2020-04-22 12:24:59
Total flows processed: 492540, Blocks skipped: 0, Bytes read: 39403680
Sys: 0.139s flows/second: 3539124.8 Wall: 0.136s flows/second: 3598781.3

Sort presented flows by duration, longest at the bottom

nfdump itself has no provision to sort flows by their duration, but we can easily pipe the output to any
Linux sorting tool. Let’s display top 10 flows by duration:

echo 'Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets
nfdump -r nfcapd.202209281905 | sort -n -k3,3 | tail -10

Output:

Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Packet
2022-09-28 18:10:08.820 3360.080 TCP 172.17.12.130:57095 -> 20.199.120.182:443 4
2022-09-28 18:10:08.820 3360.080 TCP 20.199.120.182:443 -> 172.17.12.130:57095 2
2022-09-28 18:11:48.620 3360.130 TCP 172.17.12.164:49836 -> 20.199.120.151:443 4
2022-09-28 18:11:48.620 3360.130 TCP 20.199.120.151:443 -> 172.17.12.164:49836 2
2022-09-28 17:06:18.140 7202.630 ICMP 172.17.80.245:0 -> 172.20.0.2:0.8 120
2022-09-28 09:09:36.580 35232.610 PIM 100.100.100.100:0 -> 172.17.46.254:0 0
2022-09-27 20:34:35.550 81030.200 ICMP 172.17.80.245:0 -> 87.128.226.58:0.8 1362
2022-09-27 20:34:35.550 81030.200 ICMP 87.128.226.58:0 -> 172.17.80.245:8.8 1362
2022-09-27 15:45:26.850 98610.750 ICMP 172.17.7.12:0 -> 172.17.24.127:8.8 9860
2022-09-27 15:45:26.850 98610.750 ICMP 172.17.24.127:0 -> 172.17.7.12:0.8 9859

Anonymize IP addresses in all the flows in the file, overwrite in-

place
Use bundled with nfdump tool named nfanon. To use it we have to specify a random ASCII of 32 characters
or hexadecimal string of 64 characters. The -K option accepts the random key.

To generate random 32 chars:

dd if=/dev/urandom bs=16 count=1 | hexdump -v -e '/1 "%02X "' | tr -d ' ' ; echo
1+0 records in
1+0 records out
16 bytes copied, 0.000491685 s, 32.5 kB/s
E9C11DC6F92488E7A13A1F42EF6A9E87

nfanon -K E9C11DC6F92488E7A13A1F42EF6A9E87 -r nfcapd.202004220710

Find records in the time range of 12:19:00 - 12:20:00 matching the

filter of protocol = UDP and port = 53
Using -t option we can limit the time range of the records to look into. nfdump puts 0 for any missing time
part, e.g. 12:19 means 12:19:00.

nfdump -r nfcapd.202004220920 -t 2020/04/22.12:19:00-2020/04/22.12:20:00 'port 53 and proto udp'

Output:
 Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets
2020-04-22 12:19:55.564 0.000 UDP 56.30.111.241:53 -> 216.88.40.117:64842 1
2020-04-22 12:19:55.564 0.000 UDP 216.88.40.117:64012 -> 158.174.33.78:53 1
2020-04-22 12:19:54.852 0.000 UDP 216.88.40.117:63044 -> 70.158.34.8:53 1
2020-04-22 12:19:55.712 0.000 UDP 219.154.149.77:53 -> 216.88.40.116:49880 1
2020-04-22 12:19:55.716 0.000 UDP 216.88.40.117:65172 -> 246.220.77.233:53 1
2020-04-22 12:19:55.152 0.000 UDP 216.88.40.117:63463 -> 177.234.225.103:53 1
2020-04-22 12:19:55.364 0.000 UDP 216.88.40.117:63493 -> 51.11.3.16:53 1
IP addresses anonymised
Summary: total flows: 7, total bytes: 1120, total packets: 7, avg bps: 10370, avg pps: 8, avg bpp: 1
Time window: 2020-04-22 12:19:37 - 2020-04-22 12:24:59
Total flows processed: 492540, Blocks skipped: 0, Bytes read: 39403680
Sys: 0.050s flows/second: 9713068.7 Wall: 0.048s flows/second: 10233959.4

Follow me on https://www.linkedin.com/in/yurislobodyanyuk/ not to miss what I publish on Linkedin,

Github, blog, and more.

Yuri Slobodyanyuk

Did you like this article? Share it with your friends!

© Yuri Slobodyanyuk | Atom feed  | Twitter