Traffic mirroring

Traffic Mirroring

Задача - собрать статистику (netflow) по траффику на определенные хосты. (в моем случае - одноклассники)

nslookup  odnoklassniki.ru
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	odnoklassniki.ru
Address: 5.61.23.5
Name:	odnoklassniki.ru
Address: 217.20.155.58
Name:	odnoklassniki.ru
Address: 217.20.156.159

Так как траффика много - мы миррорим только часть траффик внутрь неймспейса в котором и будем его слушать.

#!/bin/bash -x

BRCTL="/usr/sbin/brctl"
IFCONFIG='/sbin/ifconfig'
VCONFIG="/sbin/vconfig"
EBT="/sbin/ebtables"
IP="/sbin/ip"






${IP} netns add FLOW
${IP} link add dev flow_local type veth peer name flow_namespace
${IP} link set  flow_namespace netns FLOW
${IP} addr add 172.31.97.2/24 dev flow_local
${IP} link set up dev flow_local

${IP} netns exec FLOW ${IP} addr add 172.31.97.1/24 dev flow_namespace
${IP} netns exec FLOW ${IP} link set up dev flow_namespace
${IP} netns exec FLOW ${IP} link set up dev lo
#${IP} netns exec FLOW ${IP} route add 0.0.0.0/0 via 172.31.97.2

iptables -t mangle -A PREROUTING  -d 217.20.155.58  -j TEE --gateway 172.31.97.1
iptables -t mangle -A POSTROUTING -s 217.20.155.58  -j TEE --gateway 172.31.97.1

iptables -t mangle -A PREROUTING  -d 5.61.23.5      -j TEE --gateway 172.31.97.1
iptables -t mangle -A POSTROUTING -s 5.61.23.5      -j TEE --gateway 172.31.97.1

iptables -t mangle -A PREROUTING  -d 217.20.156.159 -j TEE --gateway 172.31.97.1
iptables -t mangle -A POSTROUTING -s 217.20.156.159 -j TEE --gateway 172.31.97.1

${IP} netns exec FLOW /etc/init.d/flow-capture start
${IP} netns exec FLOW /etc/init.d/fprobe  start

uname -a
Linux donec.net.ua 3.17.4-1.el6.elrepo.x86_64 #1 SMP Sat Nov 22 09:31:20 EST 2014 x86_64 x86_64 x86_64 GNU/Linux

iptables -V
iptables v1.4.9

cat /etc/sysconfig/flow-capture
# Change the source IP and port to what is used on your network
OPTIONS="-n 287 -N 0 -w /var/flow-tools -S 5 127.0.0.1/127.0.0.1/8818"

cat /etc/sysconfig/fprobe
OPTIONS="-iflow_namespace -fip -B4096 -r2 -q10000 -t10000:10000000 localhost:8818"