Free netflow cisco software for linux

flowd application is a fast, small and secure NetFlow collector.
Main features:
- Understands NetFlow protocol v.1, v.5, v.7 and v.9 (including IPv6 flows)
- Supports both IPv4 and IPv6 transport of flows
- Secure: flowd is privilege separated to limit the impact of any compromise
- Supports filtering and tagging of flows, using a packet filter-like syntax
- Stores recorded flow data in a compact binary format which supports run-time choice over which flow fields are stored
- Ships with both Perl and Python interfaces for reading and parsing the on-disk record format
- Is licensed under a liberal BSD-like license
- Supports reception of flow export datagrams sent to multicast groups (IPv4 and IPv6), thereby allowing the construction of redundant flow collector systems
flowd works with any standard NetFlow exporter, including hardware devices (e.g. routers) or software flow tracking agents, such as my own softflowd and pfflowd. Please refer to the README for more information.
The flowd daemon follows the Unix philosophy of "doing one thing well" - it doesnt try to do anything beyond accepting NetFlow packets and storing them in a standard format on disk. In particular, it does not include support for storing flows in multiple formats or performing data analysis. That sort of thing is left to external tools. The source distribution includes several example tools including a basic reporting script and one to store flows in a SQL database.
Enhancements:
- This release includes major improvements to performance and functionality.
- In particular, the flow format has been modified to store more information and be faster to read, input and output buffering has been improved, new flow filtering options have been added, and the Python API has been rewritten and extended to be many times faster.

cflowd is a flow analysis tool currently used for analyzing Ciscos NetFlow enabled switching method.

The current release (described below) includes the collections, storage, and basic analysis modules for cflowd and for arts++ libraries. This analysis package permits data collection and analysis by ISPs and network engineers in support of capacity planning, trends analysis, and characterization of workloads in a network service provider environment. Other areas where cflowd may prove useful are: tracking for Web hosting, accounting and billing, network planning and analysis, network monitoring, developing user profiles, data warehousing and mining, as well as security-related investigations.


cflowd is no longer supported by CAIDA. Instead, please consider the use of flow-tools, which will provide a toolset for working with NetFlow data. flow-tools can also be used (like cflowd) in conjunction with FlowScan, maintained by Dave Plonka at the University of Wisconsin, Madison.

NetSPoC is a tool for security managment of large computer networks with different security domains. It generates configuration files for packet filters which are controlling the borders of security domains.
NetSPoC provides its own language for describing the security policy and topology of a network. The security policy is a set of rules that state which packets are allowed to pass the network and which not. NetSPoC is topology aware: a rule for traffic from A to B is automatically applied to all managed packet filters on the path from A to B.
Currently NetSPoC generates ACLs and static routing entries for
Cisco routers with or without firewall feature set,
PIX firewalls and
Linux iptables and ip route.
It supports network address translation, virtual IP addresses for redundancy protocols like VRRP and some dynamic routing protocols.
IPSec encryption is supported as well. A powerful syntax allows to easily define a large number of crypto tunnels of either a hub and spoke topology or a fully meshed topology. Crypto rules define which type of traffic needs to be encrypted. Crypto configuration for Cisco IOS routers and PIX firewalls is generated.
NetSPoCs text based specification language is well suited for integration with CVS or other version control systems. A script is provided for tagging a policy and saving it to a policy database.
This software is actively developed with perl 5.8 under linux. It should be portable to other platforms where perl is available.
Enhancements:
- VERSION:
- TODO:
- NEWS.html:
- Prepare version 3.0.
- index.html: Mentioned crypto. Removed links to email addresses to reduce SPAM. Removed CSPM stuff.
- Netspoc.pm:
- Made code 64 bit clean. This was necessary for complement and left-shift operations on 32 bit IP addresses.

ntop is a network traffic probe that shows the network usage, similar to what the popular top Unix command does.
The project is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform and on Win32 as well.
ntop users can use a a web browser (e.g. netscape) to navigate through ntop (that acts as a web server) traffic information and get a dump of the network status.
In the latter case, ntop can be seen as a simple RMON-like agent with an embedded web interface. The use of:
a web interface
limited configuration and administration via the web interface
reduced CPU and memory usage (they vary according to network size and traffic)
make ntop easy to use and suitable for monitoring various kind of networks.
Main features:
- Sort network traffic according to many protocols
- Show network traffic sorted according to various criteria
- Display traffic statistics
- Store on disk persistent traffic statistics in RRD format
- Identify the indentity (e.g. email address) of computer users
- Passively (i.e. withou sending probe packets) identify the host OS
- Show IP traffic distribution among the various protocols
- Analyse IP traffic and sort it according to the source/destination
- Display IP Traffic Subnet matrix (whos talking to who?)
- Report IP protocol usage sorted by protocol type
- Act as a NetFlow/sFlow collector for flows generated by routers (e.g. Cisco and Juniper) or switches (e.g. Foundry Networks)
- Produce RMON-like network traffic statistics
Additional features of "ntop":
- Network Flows
- Local Traffic Analysis
- Multithread and MP (MultiProcessor) support on both Unix and Win32
- Perl/PHP/Python lightweight API for accessing ntop from remote
- Support of both NetFlow andsFlow as flow collector. ntop can collect simultaneously from multiple probes.
- Traffic statistics are saved into RRD databases for long-run traffic analysis.
- Internet Domain, AS (Autonomous Systems), VLAN (Virtual LAN) Statistics
- Network assets discovery and categorization according to their OS and users
- Protocol decoders for most of known P2P (Peer to Peer) protocols
- Advanced per user HTTP password protection with encrypted passwords
- RRD support for persistently storing per-host traffic information
- Passive remote host fingerprint (Courtesy of ettercap)
- HTTPS (Secure HTTP via OpenSSL)
- Virtual/multiple network interfaces support
- Graphical Charts (via gdchart)
- WAP support

flow-tools is a set of programs for processing and managing NetFlow exports from Cisco and Juniper routers. The tools included are: flow-capture, flow-cat, flow-dscan, flow-expire, flow-export, flow-fanout, flow-filter, flow-gen, flow-header, flow-import, flow-mask, flow-merge, flow-nfilter, flow-print, flow-receive, flow-report, flow-send, flow-split, flow-stat, flow-tag, and flow-xlate.

Flow data is collected and stored by default in host byte ordera nd the files are portable across every endian architectures.

Commands that utilize the network use a localip/remoteip/port designation for communication. "localip" is the IP address the host will use as a source for sending or bind to when receiving NetFlow PDUs (ie the destination address of the exporter. Configuring the "localip" to 0 will force the kernel to decide what IP address to use for sending and listen on all IP addresses for receiving. "remoteip" is the destination IP address used for sending or the expected address of the source when receiving. If the "remoteip" is 0 then the application will accept flows from any source address. The "port" is the UDP port number used for sending or receiving. When using multicast addresses the localip/remoteip/port is used to represent the source, group, and port respectively.

Flows are exported from a router in a number of different configurable versions. A flow is a collection of key fields and additional data. The flow key is {srcaddr, dstaddr, input, output, srcport, dstport, prot, ToS}. Flow-tools supports one export version per file.

Export versions 1, 5, 6, and 7 all maintain {nexthop, dPkts, dOctets, First, Last, flags}, ie the next-hop IP address, number of packets, number of octets (bytes), start time, end time, and flags such as the TCP header bits. Version 5 adds the additional fields {src_as, dst_as, src_mask, dst_mask}, ie source AS, destination AS, source network mask, and destination network mask. Version 7 which is specific to the Catalyst switches adds in addition to the version 5 fields {router_sc}, which is the Router IP address which populates the flow cache shortcut in the Supervisor. Version 6 which is not officially supported by Cisco adds in addition to the version 5 fields {in_encaps, out_encaps, peer_nexthop}, ie the input and output interface encapsulation size, and the IP address of the next hop within the peer. Version 1 exports do not contain a sequence number and therefore should be avoided, although it is safe to store the data as version 1 if the additional fields are not used.

Version 8 IOS NetFlow is a second level flow cache that reduces the data exported from the router. There are currently 11 formats, all of which provide {dFlows, dOctets, dPkts, First, Last} for the key fields.

8.1 - Source and Destination AS, Input and Output interface
8.2 - Protocol and Port
8.3 - Source Prefix and Input interface
8.4 - Destination Prefix and Output interface
8.5 - Source/Destination Prefix and Input/Output interface
8.9 - 8.1 + ToS
8.10 - 8.2 + ToS
8.11 - 8.3 + ToS
8.12 - 8.5 + ToS
8.13 - 8.2 + ToS
8.14 - 8.3 + ports + ToS

Version 8 CatIOS NetFlow appears to be a less fine grained first level flow cache.

8.6 - Destination IP, ToS, Marked ToS,
8.7 - Source/Destination IP, Input/Output interface, ToS, Marked ToS,
8.8 - Source/Destination IP, Source/Destination Port,
Input/Output interface, ToS, Marked ToS,

The following programs are included in the flow-tools distribution.

flow-capture - Collect, compress, store, and manage disk space for exported flows from a router.
flow-cat - Concatenate flow files. Typically flow files will contain a small window of 5 or 15 minutes of exports. Flow-cat can be used to append files for generating reports that span longer time periods.
flow-fanout - Replicate NetFlow datagrams to unicast or multicast destinations. Flow-fanout is used to facilitate multiple collectors attached to a single router.
flow-report - Generate reports for NetFlow data sets. Reports include source/destination IP pairs, source/destination AS, and top talkers. Over 50 reports are currently supported.
flow-tag - Tag flows based on IP address or AS #. Flow-tag is used to group flows by customer network. The tags can later be used with flow-fanout or flow-report to generate customer based traffic reports.
flow-filter - Filter flows based on any of the export fields. Flow-filter is used in-line with other programs to generate reports based on flows matching filter expressions.
flow-import - Import data from ASCII or cflowd format.
flow-export - Export data to ASCII or cflowd format.
flow-send - Send data over the network using the NetFlow protocol.
flow-receive - Receive exports using the NetFlow protocol without storing to disk like flow-capture.
flow-gen - Generate test data.
flow-dscan - Simple tool for detecting some types of network scanning and Denial of Service attacks.
flow-merge - Merge flow files in chronoligical order.
flow-xlate - Perform translations on some flow fields.
flow-expire - Expire flows using the same policy of flow-capture.
flow-header - Display meta information in flow file.
flow-split - Split flow files into smaller files based on size, time, or tags.

Dedalo allows the automatic drawing of the topology of a Cisco network utilizing CDP and SNMP.

Dedalo was created as a project for the course "Complements of network management" held by Dr. Luca Deri.

Inside the tarball is a pdf which contains the instructions for the compilation and its use (unfortunately its in italian, if you have problems compiling or using it send me an email).

During testing I noticed that it doesnt work on Catalyst 6500s, the topology isnt drawn well due of some inconsistencies on the port names announced via CDP.

I would like to receive feedback on Dedalos usefulness and functioning.

Net::Cisco::AccessList::Extended is a Perl module to generate Cisco extended access-lists.

SYNOPSIS

use Net::Cisco::AccessList::Extended;
my $l = Net::Cisco::AccessList::Extended->new(INCOMING_LIST);

$l->push({
access => permit,
proto => ip,
src_og => friendly_net,
dst_og => local_net,
});

print $l->dump, "n";
# prints the access-list commands to STDOUT, something like:

access-list INCOMING_LIST extended permit ip object-group friendly_net object-group local_net

Use this module to manage the presentation of Cisco Extended Access Lists. List entries are pushed into the object in a simple parmaterized fashion, and you can then dump the list in a format that is parsable by Cisco devices.

Support is included for list entries that reference Object Groups (as used by more recent PIX OS and FWSM software versions).