Netflow configuration file

How to edit

On the Trisul-Probe type sudo /usr/local/share/trisul-probe/cfgedit then select “Netflow” to edit. See Plugin Configuration

Location

In a file called PI-7CA09636-02D4-45E7-AA00-BE0D49B94E26.xml in /usr/local/etc/trisul-probe/domainX/probeX/contextX You can edit the config file directly by typing the full file name as shown below



# vi /usr/local/etc/trisul-probe/domain0/probe0/context0/PI-7CA09636-02D4-45E7-AA00-BE0D49B94E26.xml 

the above example shows how to edit the config for the default context

Parameters

The following nodes under the global Netflow policy.

Parameters Defaults Description
MeterHosts True Whether or not traffic stats for each host is metered.
MeterSubnets TRUE Whether or not traffic stats for each subnet is metered.
MeterApplications TRUE Whether or not traffic stats for each application is metered. In this context application refers to the UDP/TCP port or to special network level apps like ICMP, IPSEC, etc. In case of TCP/UDP ports, the default behavior is to only meter the lower numbered port. This works in most cases, but if you want to count both ports, set the MeterBothPorts parameter.
MeterNetflowSources TRUE If set, Trisul tracks traffic volume from each exporting router. The meters tracked are
Netflow export rate in bytes
Netflow export rate in records
Total traffic volume on router in bytes
MeterNetflowInterfaces TRUE If set, Trisul tracks traffic into and out of network interfaces.
MergeMultipleSources TRUE If set, duplicate flows from different routers will be merged.
MatchBiDirectionalFlows TRUE Netflow records are unidirectional. If set, Trisul will merge two unidirectional flows into one bidirectional flow.
If you set this option to false, Trisul will retain the uni-directional flow as-is.
UseRouterTimestamps FALSE If set, Trisul will use the timestamp from the Netflow records.
If not set, Trisul will use the timestamp at the server running Trisul. This is the default and recommended option unless you have routers which synchronize their timestamps automatically.
MergeHTTP FALSE For HTTP flows, ignore the Source Ephemeral Port and set it to 65535. NOTE When the MergeX option is used flows will not be terminate but timed out. Use the MergeX options to reduce the number of unique flows
MergeHTTPS FALSE For HTTPS flows, ignore the Source Ephemeral Port and set it to 65535.
MergeDNS FALSE For DNS flows, ignore the Source Ephemeral Port. Set to FALSE, every DNS transaction will be a separate flow
IgnoreESP FALSE Ignore IPSEC ESP flows. These are tunneled interfaces containing no flow information within them.
MeterHomeNetwork TRUE Classifies traffic relative to your Home Network.
INCOMING Destination IP is in your home network but Source IP is not
OUTGOING Source IP is in your home network but Destination IP is not
INTERNAL Both the Source IP and Destination IP are in your home network
TRANSIT Both the Source IP and Destination IP are not in your home network
MeterBothPorts FALSE When set to FALSE : The default behaviour of Trisul is to only meter the low numbered port. The assumption is that low numbered ports represent servers. This is usually accurate for traditional server applications that run below port 1024.
When set to TRUE : Meters both ports for applications above port 1024. Ports below 1024 (such as HTTP) are still counted in the normal way.
Set this to TRUE if you have P2P / VoIP Traffic you wish to track.
MeterTCPConnections TRUE Meter connection count for the flow TCP end point IPs. This allows you to get reports for hosts with maximum connections, etc
MeterAppConnections TRUE Meter connection count for source and destination ports for TCP based application.
FilterInterfacesInclude A comma separated list of interfaces.
When set, Trisul will accept and process flows that exit or enter these interfaces. This can be in routerip_ifindex format or Trisul key format
An example
If you only want to accept flows that use the WAN link (if Index = 108) on router (122.166.4.242) and GigE link (ifIndex = 120) also on router (122.166.4.242)
You should specify the interfaces as 122.166.2.242_108,122.166.242.100_120
FilterInterfacesExclude A comma separated list of interfaces.
When set, Trisul will only process flows that DO NOT use these interfaces.
The format is same as the parameter FilterInterfacesInclude
NOTE Note that you cannot use the FilterInterfacesInclude and Exclude parameters at the same time.
CheckPacketsForCorruption FALSE Turns on heuristics to check each netflow record for corruption. When set to TRUE, Trisul validates the timestamps, packets, bytes, etc. We have seen unpatched routers transmit corrupted records, which can distort the metrics and charts.
LogTemplateMessages TRUE If enabled , Trisul will log template updates to the probe log files. Disable if you feel there are too many of these messages.
IgnoreV9EgressFromDevices Sometimes we find that customers erroneously enable both Netflow v9 INGRESS and EGRESS on all ports. This will result in double counting. The solution is to only configure INGRESS+EGRESS on a single port such as the uplink ports. Oftentimes, we are unable to get the Netflow change request done. This option allows you to adjust for this. This option contains a comma separated list of IP addresses of devices from which Trisul will ignore EGRESS netflow V9 records. The following example ignores Netflow v9 EGRESS from two devices
<IgnoreV9EgressFromDevices>172.16.13.31,172.16.13.36 .
EnableShimTunnel FALSE If Enabled, Trisul will decapsulate the special SHIM tunnel used to forward Netflow packets from a remote network to the Trisul probe. Normal Netflow will also be processed correctly. For more information see on Github netflow-shim-tunnel
HomeASNumbers Enter a comma separated list of Home AS and Downstream AS numbers. Used in ISP deployments these are the AS numbers of the customer running Trisul. If Home AS numbers are present they are used instead of Home Network Prefixes to determine per-AS Upload (egress) and Download (ingress) traffic metrics per AS and also to split upstream vs downstream
AddEdges TRUE Adds ASN <—> PREFIX edges. If enables, it allows you to select a AS and see which PREFIXES are active in that AS. Here active means prefixes which had some traffic in the selected interval
MeterLinkAS FALSE Flow-Link-ASN is a special Crosskey Counter Group which tracks network interface > AS flows. Setting this option to TRUE, enables that counter group. You can then visualize these flows using the Sankey App
UsePostNATAddresses TRUE This is Neflow Template option supported on some devices such Palo Alto. Set this to TRUE to use Post-NAT IP address which represent the actual end user in our organization rather than the WAN address.
TemplateDumpIntervalSeconds 600 How frequently must the template database be dumped by the probes. These are shown on the Admin > Show Template DB page. Set this to 0 to prevent template databases being dumped
MeterZeroFlows FALSE Use case Large ISP compliance logging. When compliance only asks for connection logs without collecting byte and packet counts, enabel this option
AllowVariableLengthStrings FALSE IPFIX variable length strings in templates are used by some network vendors to export labels and tags using IPFIX template field type 65535
TagFlowsWithUserID FALSE Some vendors will export flows with a User-ID string which identifies the pre-NAT user of the flow, this appends a tag each flow. See Trisul Flow Taggers
MeterUserID FALSE If User-ID string is present, meter bytes, flows, connections for it
MeterAppID FALSE If App-ID string is present, meter bytes, flows, connections for it

Sampling rates

Flow sampling is a technique used by very busy devices to reduce CPU load. If you configure a sampling rate of 128, the device will only process every 128 packets. In IPFIX and some other technologies, this sampling rate is not reported in the template packet itself. Use this section to manually configure the sample rate.

Add a separate line for each router as shown below

To edit the Netflow configuration file use cfgedit or edit the config file directly. See how to edit at the top of this page.

<SamplingRates>
    <Rate router="180.179.97.253"   rate="128"  />
</SamplingRates>

Advanced

Static Templates

Typically you dont need to use this section. We have used this section in the past to address various firmware bugs in some devices which did not export Netflow templates correctly. Templates fields specified in this section will override those received on the network.