NetFlow - PortTracker Exercises

1 Optional Tasks

1.1 Installing the PortTracker plugin (Optional or as reference)

This exercise assumes you already built nfdump from source with options --enable-nfprofile and --enable-nftrack, with nftrack installed under /usr/local/bin. If not, see exercise2-install-nfdump-nfsen.

$ sudo mkdir /var/ports-db
$ sudo chown netflow /var/ports-db
$ cd
$ cd nfsen-1.3.6p1/contrib/PortTracker
$ editor

    Find the line:

my $PORTSDBDIR = "/data/ports-db";

    and change it to:

my $PORTSDBDIR = "/var/ports-db";

Save and exit from the file.

$ sudo cp /var/nfsen/plugins/
$ sudo cp PortTracker.php /var/www/nfsen/plugins/
$ cd /var/nfsen/etc
$ sudo editor nfsen.conf
@plugins = (
   [ 'live', 'PortTracker'],

Save and exit from the file.

$ sudo -u netflow nftrack -I -d /var/ports-db

(This can take a LONG time! - 8 GB worth of files will be created)

$ sudo chown -R netflow:www-data /var/ports-db
$ sudo chmod 775 /var/ports-db
$ sudo chmod 664 /var/ports-db/*
$ sudo service nfsen reload
$ grep -i 'porttracker.*success' /var/log/syslog
Oct 12 13:19:35 pc1 nfsen[28005]: Loading plugin 'PortTracker': Success
Oct 12 13:19:35 pc1 nfsen[28005]: Initializing plugin 'PortTracker': Success

... and select the Plugins tab.

You may get an error that "No plugins available!": if so, quit and re-start your browser.

You may get "Error reading stat". You will need to wait a few minutes before NfSen will begin to show the graphs.

At this point you are done. Congratulations!

1.2 Troubleshooting

If you get "Error reading stat", check the /var/ports-db directory for 2 additional files: portstat24.txt and portstat.txt like this:

$ ls -l /var/ports-db/portstat*
-rw-r--r-- 1 netflow www-data     512 Jul 17 21:20 /var/ports-db/portstat24.txt

If either is missing then this will cause the problem. Make sure that nfsen can write in that directory.

You can get additional debugging by setting $DEBUG = 1 in /var/www/nfsen/conf.php, and then looking in /var/tmp/nfsen.log