Netflow is the protocol developed by Cisco to manage data about IP traffic. In a few words using Netflow you can collect data about all IP data send/received on multiple Cisco/Linux/BSD/Juniper hosts and send it to central Netflow collector that will show you the nice graphs and also will allow to have a complete picture of what data was sent/received on those hosts (including destination and source IP, port, bytes transfered, int/out interfaces etc). Nfdump is netflow collector. Nfsen is graphical tools for generating graphs and querying Nfdump for historical traffic reports. In this article you will see how to deploy all this staff in Linux.

Netflow probe is required to collect IP traffic data on Linux host. In general this piece of sofware will sit in background, store every network activity on certain network interface and then send collected data to Netflow collector nfdump. As Netflow probe I prefer fprobe that is totally simple application that just does its job. If you feel that fprobe is not what you need or there are some problems with installing it you can try softflowd that can do the same job.

Install fprobe from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/fprobe/files/fprobe/1.1/fprobe-1.1.tar.bz2/download
tar -xvjf fprobe-1.1.tar.bz2
cd fprobe-1.1
./configure --prefix=/
make
make install

Point fprobe to one of network interfaces of Linux host and make it to send data to Netflow collector:

fprobe -i eth0 11.22.33.44:23456

In above example fprobe stores all data trasnfers on eth0 network interface and sends collected data to 11.22.33.44 host via 23456 UDP port (you may want to change firewall rules to make Netflow working over 23456 UDP port).

Install nfdump Netflow collector from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.2/nfdump-1.6.2.tar.gz/download
tar -xvzf nfdump-1.6.2.tar.gz
cd nfdump-1.6.2
./configure --prefix=/ --enable-nfprofile
make make
install

When finished Netflow collector becomes ready so you can start capturing traffic from Netflow probe. If you don’t need any graphical tools like nfsen described below you can just start collector and save Netflow data in /var/neflow/ directory (THIS STEP IS OPTIONAL):

/bin/nfcapd -w -D -p 23456 -B 200000 -S 1 -z -I Linux-Host-1-eth0 -l /var/netflow/

In order to install nfsen from sources you have to get all its prerequisites, run one of below lines depending on what Linux distro you’re using (1st line is for Fedora, Centos, Redhat while 2nd line is for Ubuntu, Debian, Mint and similar):

yum install rrdtool rrdtool-devel rrdutils perl-rrdtool -y

or

aptitude install rrdtool librrd2-dev librrd-dev librrd4 librrds-perl librrdp-perl

Compile nfsen from sources:

cd /usr/src/
sudo -s
wget http://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.5/nfsen-1.3.5.tar.gz/download
tar -xvzf nfsen-1.3.5.tar.gz
cd nfsen-1.3.5
cp etc/nfsen-dist.conf etc/nfsen.conf

In order to continue the installation you should edit file etc/nfsen.conf to specify where to install nfsen, web server’s username (yes, you have to install apache, lighttpd, nginx or any other web server first), its document root directory etc. The major section of that config file is ‘Netflow sources’ that must list all hosts you’ve started Netflow probes at. Here is an example section for monitoring above Linux host:

%sources = (
    'Linux-Host-eth0'    => { 'port' => '23456', 'col' => '#ff0000', 'type' => 'netflow' },
);

When finished it’s time to actually install nfsen using installation script:

./install.pl etc/nfsen.conf

In case of successful installation you will be notified with corresponding congratulations message so it would be proper time to start nfsen daemon:

/path/to/nfsen/bin/nfsen start

Now you can open http://localhost/nfsen/nfsen.php at Linux host where nfsen was installed to start using this Netflow tool and see some graphs. Notice that it takes about 5-10 minutes to see first bars at the graphs, if the graphs are still empty you will have to check at least the following:

1. If fprobe is able to communicate to Netwflow collector and can send Netflow data to it (use ‘ps ax | grep fprobe’ and Linux host being monitored and tcpdump tool at Netflow collector).
2. If Netflow collector is started and can receive data from Netflow probe. Use ‘ps ax | grep nfcapd’ and tcpdump at Netflow collector Linux host.

If you can add anything — feel free to drop a comment below.

First of all, let’s see current port range available for TCP sessions:

cat /proc/sys/net/ipv4/ip_local_port_range

Most likely the output will show something like this one “32786 65536″. In order to expand this range you can either echo modified range into above file in /proc filesystem (temporary solution) or add corresponding line into /etc/sysctl.conf (constant solution).

To temporarily expand port range from 28,232 to 40,000 do the following:

sudo -s
echo "25000 65000" > /proc/sys/net/ipv4/ip_local_port_range

To make sure new port range will be applied after reboot add the following line to /etc/sysctl.conf:

net.ipv4.ip_local_port_range="25000 65000"

or just execute this:

sudo sysctl -n net.ipv4.ip_local_port_range="25000 65000"

All what you need to have to start using namebench is Python and Tk library, e.g. if you use Ubuntu or Debian just run the following command to meet namebench library requirements:

sudo apt-get install python python-tk -y

When done go to namebench’s official website and download the latest tarball from there. For example 1.3.1 is the latest version for today so you can download it directly from here. Or you can just take below steps:

cd /usr/src
sudo -s
wget http://code.google.com/p/namebench/downloads/detail?name=namebench-1.3.1-source.tgz
tar -xvzf namebench-1.3.1-source.tgz
cd namebench-1.3.1
./namebench.py


Here you go:

The application has the only button so I believe it won’t bring any problems even to Linux newbies

Below is beginner’s guide that helps to quickly deploy netflow collector and visualizer under Linux and impress everybody by cute and descriptive graphs like these:

It is highly recommended to look through Netflow basics to get brief understanding of how it works before configuring anything. For example, here is Cisco’s document that gives complete information about Netflow. In a few words to get started you should enable netflow exporting on Cisco router and point it to netflow collector running under Linux. Exported data will contain complete information about all packets the router has received/sent so nfdump and nfsen working under Linux will collect it and visualize to present you the graph like above example.

Cisco Router Setup

1. Enable flow export on ALL Cisco router’s interfaces that send and receive some traffic, here is an example:

Router1# configure terminal
Router1(config)#interface FastEthernet 0/0
Router1(config-if)#ip route-cache flow input
Router1(config-if)#interface FastEthernet 0/1
Router1(config-if)#ip route-cache flow input
...

2. Setup netflow export:

Router1# configure terminal
Router1(config)#ip flow-export source FastEthernet0/0
Router1(config)#ip flow-export source FastEthernet0/1
Router1(config)#ip flow-export version 5
Router1(config)#ip flow-export destination 1.1.1.1 23456

Where 1.1.1.1 is IP address of Linux host where you plan to collect and analyze netflow data. 23456 is port number of netflow collector running on Linux.

Linux Setup

1. Download and install nfdump.

cd /usr/src/
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.2/nfdump-1.6.2.tar.gz/download
tar -xvzf nfdump-1.6.2.tar.gz
cd nfdump-1.6.2
./configure --prefix=/ --enable-nfprofile
make
make install

2. Download and install nfsen.

It requires web server with php module and RRD so make sure you have the corresponding packages installed. I hope you’re running httpd with php already so below are rrd/perl related packages installation hints only.

Fedora/Centos/Redhat users should type this:

yum install rrdtool rrdtool-devel rrdutils perl-rrdtool

Ubuntu/Debian:

aptitude install rrdtool librrd2-dev librrd-dev librrd4 librrds-perl librrdp-perl

If you run some exotic Linux distribution just install everything that is related to rrd + perl.

At last, nfsen installation:

cd /usr/src/
wget http://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.5/nfsen-1.3.5.tar.gz/download
tar -xvzf nfsen-1.3.5.tar.gz
cd nfsen-1.3.5
cp etc/nfsen-dist.conf etc/nfsen.conf

In order to continue you should edit file etc/nfsen.conf to specify where to install nfsen, web server’s username, its document root directory etc. That file is commented so there shouldn’t be serious problems with it.

One of the major sections of nfsen.conf is ‘Netflow sources’, it should contain exactly the same port number(s) you’ve configured Cisco with — recall ‘ip flow-export …’ line where we’ve specified port 23456. E.g.

%sources = (
    'Router1'    => { 'port' => '23456', 'col' => '#0000ff', 'type' => 'netflow' },
);

Now it’s time to finish the installation:

./install.pl etc/nfsen.conf

In case of success you’ll see corresponding notification after which you will have to start nfsen daemon to get the ball rolling:

/path/to/nfsen/bin/nfsen start

From this point nfdump started collecting netflow data exported by Cisco router and nfsen is hardly working to visualize it — just open web browser and go to http://linux_web_server/nfsen/nfsen.php to make sure. If you see empty graphs just wait for a while to let nfsen to collect enough data to visualize it.

That’s it!

sudo aptitude install pdftk
(if you run Fedora, RedHat or CentOS use this one: sudo yum install pdftk)

Split large pdf into many one-page files:

pdftk largepdfile.pdf burst

(as the result you will get many small files like pg_0001.pdf, pg_0002.pdf and so on).

Merge files into one PDF file:

pdftk *.pdf cat output onelargepdfile.pdf

pdftk is extremely powerful and makes it possible to do almost anything with input pdf files. Thus above two commands are just examples showing how to split and merge pdf files in Ubuntu easily.

Rather long preface but solution is quite simple. If u run Ubuntu you can try lxsplit utility for breaking files into parts (binary packages for other Linux distributions as well as source code are available at lxsplit project’s homepage.):

sudo apt-get install lxsplit

In order to split some file in 3.99GB parts use the following command:

lxsplit -s /path/to/hugemoviefile.mkv 3999M

Depending on size of hugemoviefile.mkv you will get several parts hugemoviefile.mkv.001, hugemoviefile.mkv.002 and so on stored in current directory. It means that if you’re going to store those parts on some external storage like ipod you can do the following:

cd /media/ipod/
lxsplit -s /path/to/hugemoviefile.mkv 3999M

and hugemoviefile.mkv.001.. will saved in /media/ipod/ directory regardless where hugemoviefile.mkv is located.

Now coming to assembling procedure. It’s just as easy as splitting:

lxsplit -j hugemoviefile.mkv.001

Once done you will get hugemoviefile.mkv saved in current directory.

Have an interesting article? You’re welcome to contact me and get it published at LinuxScrew.com!

Anyways sometimes Packet Tracer as like as dynamips/gns3 are not a panacea when it’s necessary to emulate mid-sized network or test some specific ios features on real Cisco devices. There are several options: the first and the easiest one means to buy Cisco device. But we all know that Cisco’s pricing policy is far away from democratic in application to individual users so even used or refurbished Cisco router/switch will cost enough to think about another option. Second option is to schedule access to Community Lab at packetlife.net. Nice to know the access to it is absolutely free so anyone can get logon to Cisco routers, switches or ASAs once user reached his/her timeslot. Here is the list of hardware you can have access to (there are multiple devices of the same model):

Cisco ASA 5505
Cisco 2811 (2xWIC-2T)
Cisco 1841 (1xWIC-2T)
Cisco Catalyst 3550-24

Not bad for free lab as for me. The lab is broken into two blocks so user can reserve only one block or both blocks simultaneously. This is to make it possible to access the lab by multiple users simultaneously. Devices are connected to each other according to predefined topology — see separate diagrams for Ethernet and Serial connections below (they are split to prevent overhead on the graph I guess). All documentation as well as FAQs can be found here: here and here. Thanks to Jeremy Stretch.

P.S. By the way if you can share any other similar labs allowing people on the web to access Cisco (or some other networking devices) — you are welcome to share this information here. Thanks!

sudo apt-get install youtube-dl
Let’s imagine you would like to download the following video: http://www.youtube.com/watch?v=2leg8mUE9rs (this is part of Military Parade at Red Square in Russia at 9th of May 2010). Just run youtube-dl download utility as follows:

youtube-dl http://www.youtube.com/watch?v=2leg8mUE9rs

and in a few minutes you will get 2leg8mUE9rs.flv file that could be viewed using almost any video player like my favorite one VLC.

For rather long time I’ve been using gtkpod, amarok, banshee, exaile or rhythmbox to sync my ipod under Linux/Ubuntu and load my music collection there. As we all know The Elder Brother Apple fights with interoperability and makes ipod/iphone users to use iTunes only. Any other applications that can read/write to ipod data format are prohibited by Apple. This also concerns Rockbox and ipod4linux alternative firmwares — once Apple encrypted ipod firmware it became impossible to use them. It definitely sucks. At least due to the fact there are millions of Linux users who are real or potential customers of Apple products. Anyways these facts have been discussed in various forums, blogs like this and similar but this post about how to install Windows as the second operating system along with Ubuntu or any other Linux.

The first that we need to do is to create new partition for Windows and format it to NTFS. Exact steps to accomplish this depend on your HDD partition table e.g. there is one large ext3/ext4 partition for Ubuntu or there are several partitions for various distributions or mount points. Anyway you should use partition manager to create and/or format NTFS partition. I use gparted. It is graphical and it just works (use ‘sudo apt-get install gparted‘ if you run Ubuntu/Debian).

Second you should backup your MBR record and restore it after Windows installation that silently erases existing bootloader and installs windows one, use “dd if=/dev/sda of=/mbr.bin bs=446 count=1” to save MRB into mbr.bin file and “dd if=/media/sda/mbr.bin of=/dev/sda bs=446 count=1” to restore it from file to HDD.

To sum everything up here is the algorithm:

0. BACKUP ALL YOUR DATA!
1. Create NTFS partition using gparted.
2. Backup MBR using dd command e.g. “dd if=/dev/sda of=/mbr.bin bs=446 count=1″ (/dev/sda means your HDD).
3. Boot Windows installation CD and install it onto newly created NTFS partition.
4. Boot into Linux live CD  e.g. Ubuntu Live CD.
5. Restore MBR using dd e.g. “dd if=/media/sda/mbr.bin of=/dev/sda bs=446 count=1″.
6. Reboot.
7. Select Ubuntu in grub menu and boot it.
8. Setup grup for Windows booting.

In order to accomplish the last 8th item you should add the following text block to the end of grub config (read this article for detailed information):

title Microsoft Windows XP
root (hd0,1)
savedefault
makeactive
chainloader +1

Good luck!

P.S. If something goes wrong or you need more details you can take a look at the following article at ubuntu.com: Recovering Ubuntu After Installing Windows. It’s written in rather tangled manner but still informative.