====== Пакет nfdump ======

  * NetFlow
  * [[https://ixnfo.com/ustanovka-nfdump.html|Установка и использование Nfdump]]

<code>
# apt install nfdump

# man nfcapd

# cat /etc/nfdump/default.conf
</code><code>
...
options='-S 2 -l /var/cache/nfdump -p 2055'
</code><code>
# service nfdump restart

# ps auxwww | grep nfcapd

# nfdump -o csv -R /var/cache/nfdump/ | head -n1
</code><code>
ts,te,td,sa,da,sp,dp,pr,flg,fwd,stos,ipkt,ibyt,opkt,obyt,in,out,sas,das,smk,dmk,dtos,dir,nh,nhb,svln,dvln,ismc,odmc,idmc,osmc,mpls1,mpls2,mpls3,mpls4,mpls5,mpls6,mpls7,mpls8,mpls9,mpls10,cl,sl,al,ra,eng,exid,tr
</code><code>
# man nfdump
/OUTPUT FORMAT

# nfdump -o csv -q -R /var/cache/nfdump/ | grep 192.168.X.101

# nfdump -o csv -q -R /var/cache/nfdump/ 'proto tcp and src ip 192.168.X.101'

# nfdump -o csv -q -A dstip -R /var/cache/nfdump/2022/03/ 'dst net 192.168.X.0/24' | cut -d',' -f5,12,13
</code>