1

I use VMWare created two VMs on my Windows Server.

two VM all are CentOS-7.2.

My FastNetMon version is bellow:

/opt/fastnetmon/fastnetmon --version
Version: 1.1.3 master git-94f4947e87753b8be193ca54d17dac24cac599fb

Every one have two network interface, one is NAT , the other is hostly.

The VM1's addresses are: 45.117.42.135(NAT), 10.1.1.135(hostly) The VM2's addresses are: 45.117.42.136(NAT), 10.1.1.136(hostly)

The VM1 install the FastNetMon, and iperf, and the VM2 installed iperf:

The FastNetMon installation link: https://fastnetmon.com/install/ Iperf just use yum install -y iperf can access it.

In the VM1, runs the fastnetmon server in daemon, and fastnetmon_client:

# /opt/fastnetmon/fastnetmon --daemonize

and runs iperf:

# iperf -s -u

In the VM2, I use iperf to send UDP packages to VM1:

# iperf -u -c 10.1.1.135 -b 200M -P 5 
------------------------------------------------------------
Client connecting to 10.1.1.135, UDP port 5001
Sending 1470 byte datagrams, IPG target: 56.08 us (kalman adjust)
UDP buffer size:  208 KByte (default)
------------------------------------------------------------
[  7] local 10.1.1.136 port 33686 connected with 10.1.1.135 port 5001
[  3] local 10.1.1.136 port 38157 connected with 10.1.1.135 port 5001
[  5] local 10.1.1.136 port 47362 connected with 10.1.1.135 port 5001
[  6] local 10.1.1.136 port 34624 connected with 10.1.1.135 port 5001
[  4] local 10.1.1.136 port 55399 connected with 10.1.1.135 port 5001
[ ID] Interval       Transfer     Bandwidth
[  7]  0.0-10.0 sec   250 MBytes   210 Mbits/sec
[  7] Sent 178328 datagrams
[  3]  0.0-10.0 sec  7.18 KBytes  5.88 Kbits/sec
[  3] Sent 5 datagrams
[  5]  0.0-10.0 sec  1.44 KBytes  1.18 Kbits/sec
[  5] Sent 1 datagrams
[  6]  0.0-10.0 sec  1.44 KBytes  1.18 Kbits/sec
[  6] Sent 1 datagrams
[  4]  0.0-10.0 sec   250 MBytes   210 Mbits/sec
[  4] Sent 178317 datagrams
[SUM]  0.0-10.0 sec   500 MBytes   419 Mbits/sec
[SUM] Sent 356652 datagrams
[  6] Server Report:
[  6]  0.0-10.0 sec   249 MBytes   209 Mbits/sec   0.025 ms  556/178324 (0.31%)
[  6] 0.00-10.00 sec  64 datagrams received out-of-order
[  7] Server Report:
[  7]  0.0-10.0 sec   249 MBytes   209 Mbits/sec   0.000 ms  736/178328 (0%)
[  7] 0.00-10.00 sec  1 datagrams received out-of-order
[  3] Server Report:
[  3]  0.0-10.0 sec   247 MBytes   207 Mbits/sec   0.017 ms 2045/178303 (1.1%)
[  3] 0.00-10.01 sec  56 datagrams received out-of-order
[  4] Server Report:
[  4]  0.0-10.0 sec   245 MBytes   206 Mbits/sec   0.030 ms 3570/178317 (2%)
[  5] Server Report:
[  5]  0.0-10.0 sec   249 MBytes   208 Mbits/sec   0.028 ms 1053/178326 (0.59%)

In the VM1, I get the bellow prints:

[  8] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 38695
[  3] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 60248
[  4] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 58492
[  5] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 47149
[  6] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 53030
[  3]  0.0-10.0 sec   247 MBytes   207 Mbits/sec   0.013 ms 1932/178319 (1.1%)
[  3] 0.00-10.00 sec  132 datagrams received out-of-order
[  5]  0.0-10.0 sec   249 MBytes   209 Mbits/sec   0.007 ms  956/178316 (0.54%)
[  6]  0.0-10.0 sec   249 MBytes   209 Mbits/sec   0.015 ms  922/178318 (0.52%)
[  8]  0.0-10.0 sec   249 MBytes   208 Mbits/sec   0.026 ms 1040/178320 (0.58%)
[  8] 0.00-10.00 sec  2 datagrams received out-of-order
[  4]  0.0-10.0 sec   248 MBytes   208 Mbits/sec   0.026 ms 1326/178326 (0.74%)
[  4] 0.00-10.00 sec  41 datagrams received out-of-order
[SUM]  0.0-10.0 sec  1.21 GBytes  1.04 Gbits/sec   0.026 ms 6176/891599 (0.69%)
[SUM] 0.00-10.00 sec  175 datagrams received out-of-order

But in the VM1's fastnetmon, the Incoming Traffic, Outcoming Traffic always are 0:

enter image description here (I am sorry for snapshot, not code, because I can not copy it )

Why they are 0? no influence?

It also do not listen the TCP datagrams.


EDIT

The bellow is my fastnetmon.conf :

# cat  /etc/fastnetmon.conf | grep -v "#" |grep -v "^;"|grep -v "^$"
logging:local_syslog_logging = off
logging:remote_syslog_logging = off
logging:remote_syslog_server = 10.10.10.10
logging:remote_syslog_port = 514
enable_ban = on
process_incoming_traffic = on
process_outgoing_traffic = on
ban_details_records_count = 500
ban_time = 1900
unban_only_if_attack_finished = on
enable_subnet_counters = off
networks_list_path = /etc/networks_list
white_list_path = /etc/networks_whitelist
check_period = 1
enable_connection_tracking = off
ban_for_pps = on
ban_for_bandwidth = on
ban_for_flows = off
threshold_pps = 200
threshold_mbps = 10
threshold_flows = 350
threshold_tcp_mbps = 100000
threshold_udp_mbps = 100000
threshold_icmp_mbps = 100000
threshold_tcp_pps = 100000
threshold_udp_pps = 100000
threshold_icmp_pps = 100000
ban_for_tcp_bandwidth = off
ban_for_udp_bandwidth = off
ban_for_icmp_bandwidth = off
ban_for_tcp_pps = off 
ban_for_udp_pps = off
ban_for_icmp_pps = off
mirror = off
pfring_sampling_ratio = 1
mirror_netmap = off
mirror_snabbswitch = off
mirror_afpacket = off
interfaces = eno16777,eno33554
netmap_sampling_ratio = 1
netmap_read_packet_length_from_ip_header = off
pcap = off
netflow = on
sflow = on
enable_pf_ring_zc_mode = off
interfaces = eno16777,eno33554
average_calculation_time = 5
average_calculation_time_for_subnets = 20
netflow_port = 2055
netflow_host = 0.0.0.0
netflow_sampling_ratio = 1
netflow_divide_counters_on_interval_length = off
sflow_port = 6343
sflow_host = 0.0.0.0
notify_script_path = /usr/local/bin/notify_about_attack.sh
notify_script_pass_details = on
collect_attack_pcap_dumps = off
process_pcap_attack_dumps_with_dpi = off
redis_enabled = off
redis_port = 6379
redis_host = 127.0.0.1
redis_prefix = mydc1
mongodb_enabled = off
mongodb_host = localhost
mongodb_port = 27017
mongodb_database_name = fastnetmon
pfring_hardware_filters_enabled = off
exabgp = off
exabgp_command_pipe = /var/run/exabgp.cmd
exabgp_community = 65001:666
exabgp_next_hop = 10.0.3.114
exabgp_announce_host = on
exabgp_announce_whole_subnet = off
exabgp_flow_spec_announces = off
gobgp = off
gobgp_next_hop = 0.0.0.0
gobgp_announce_host = on
gobgp_announce_whole_subnet = off
graphite = off
graphite_host = 127.0.0.1
graphite_port = 2003
graphite_prefix = fastnetmon
monitor_local_ip_addresses = on
hostgroup = my_hosts:10.10.10.221/32,10.10.10.222/32
my_hosts_enable_ban = off
my_hosts_ban_for_pps = off
my_hosts_ban_for_bandwidth = off
my_hosts_ban_for_flows = off
my_hosts_threshold_pps = 20000
my_hosts_threshold_mbps = 1000
my_hosts_threshold_flows = 3500
pid_path = /var/run/fastnetmon.pid
cli_stats_file_path = /tmp/fastnetmon.dat
enable_api = off
sort_parameter = packets
max_ips_in_list = 7

My /etc/networks_list is bellow:

10.1.1.0/24
45.117.42.0/24

EDIT -2

I tried open the PF_RING in /etc/fastnetmon.conf:

mirror = on

and restart fastnetmon, it can not startup. in the /var/log/fastnetmon.log:

[ERROR] PF_RING initilization failed, exit from programm

I use lsmod to check, find nothing:

# lsmod |grep pf_ring

So the PF_RING did not install success.

I also open the pcap to capture the traffic, still can not run the fastnetmon success.


EDIT-3

At last, I install the PF_RING success, and open the mirror=on, then I can see the internal traffic now:

enter image description here

My problem now is But why my Incoming traffic and Outgoing traffic still 0? I mean if I use DDoS to attack it, it still is 0, the internal traffic will increase up quickly.

and I also installed the influxdb:

# influx
Visit https://enterprise.influxdata.com to register for updates, InfluxDB server management, and monitoring.
Connected to http://localhost:8086 version 0.13.0
InfluxDB shell version: 0.13.0
> show databases
name: databases
---------------
name
graphite
_internal
flow_dc1

> use graphite
Using database graphite
> show measurements
name: measurements
------------------
name
hosts
total

> 

Find there is no measurements, it should like this:

> use graphite
Using database graphite
> show measurements
name: measurements
------------------
name
fastnetmon.10_1_2_137.incoming.flows
fastnetmon.10_1_2_137.incoming.mbps
fastnetmon.10_1_2_137.incoming.pps
fastnetmon.10_1_2_137.outgoing.flows
fastnetmon.10_1_2_137.outgoing.mbps
fastnetmon.10_1_2_137.outgoing.pps
fastnetmon.172_26_1_1.incoming.flows
fastnetmon.172_26_1_1.incoming.mbps
fastnetmon.172_26_1_1.incoming.pps
fastnetmon.172_26_1_1.outgoing.flows
fastnetmon.172_26_1_1.outgoing.mbps
fastnetmon.172_26_1_1.outgoing.pps
fastnetmon.incoming.mbps
fastnetmon.incoming.pps
fastnetmon.incomingflows
fastnetmon.outgoing.mbps
fastnetmon.outgoing.pps
fastnetmon.outgoingflows

> select * from "fastnetmon.incoming.pps" order by time desc limit 10
name: fastnetmon.incoming.pps
-----------------------------
time            value
1465079546000000000 0
1465079545000000000 0
1465079544000000000 3
1465079543000000000 0
1465079542000000000 2
1465079541000000000 0
1465079540000000000 0
1465079539000000000 0
1465079538000000000 0
1465079537000000000 0 

1 Answer 1

0

You configured fastnetmon to use netflow and sflow. Did you configure a tool to generate netflow or sflow data based on your network traffic? If not, you need to configure fasnetmon to inspect interface traffic or change the backend in the fastnetmon config to something which can read interface statistics, like netmap or pf_ring. Basically, the way you generate data should match your configuration.

For some more details check out https://fastnetmon.com/docs/capture_backends/

3
  • See my EDIT-2, frind, actually I know the PF_RING did not instlall success by the official script.
    – aircraft
    Jan 8, 2018 at 6:52
  • You really need to read the documentation. FastNetMon is not a 'install and run' type of program. You need to understand what it does and choose in which way you want to deploy it. Everything depends on that.
    – Teun Vink
    Jan 8, 2018 at 7:54
  • I have installed PF_RING, You can see my EDIT-3, thank you. but how about the incoming traffic and outgoing traffic still 0?
    – aircraft
    Jan 8, 2018 at 8:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .