Fprobe Software At The

If the monitoring point is placed on the public network interface, the captured addresses are all public network addresses.

If the monitoring point is deployed on the load balancing internal network interface, the captured data can be divided into public network address and internal network address.

At this time, it should be noted that if you want to use fprobe for 1:1 sampling, you need to mirror the traffic to a linux physical server.

The virtual machine should not be allowed, because the virtual opportunity discards the packets of the non target address and cannot capture the mirrored packets.

If you use multi line bgp to connect with the operators, please check the switch documents first and then mirror them Like configuration, to avoid the impact of image port congestion on the packets in and out of the service port.

If the load balancing is a linux server, fprobe can be directly deployed on the linux server.

If fprobe cannot be used, image data needs to be sent to a linux physical server, and then processed by fprobe.

Select the switch gateway, and use the netflow configuration of the switch directly, but pay attention to the sampling ratio to prevent excessive cpu memory consumption and production impact.

The script determines the start command of fprobe by looking up port 9999.

Fprobe Software At The

Two nfdump receivers use the keepalived software at the same time.

Once the main device goes down, the standby device immediately carries Vip.

If the firewall policy is not enabled, there will be two devices carrying Vip at the same time.

This situation is very bad, because Vip will occupy each other, resulting in data can not be received continuously.

Execute the following command to add the policy of releasing vrrp protocol.

Please run the script after the nfcapd file is generated normally.

The storage location in this instance is: data1netflownetflowneiwang.

How To Install Fprobe