http://www.packetanalytics.com/community/index EN Wed, 30 Apr 2008 08:56:58 -0500 Wed, 30 Apr 2008 08:56:58 -0500 Packet Analytics User Community Phorum 5.1.25 60 http://www.packetanalytics.com/community/read/5/23/23#msg-23 benuphoff
http://www.net-security.org/dl/insecure/INSECURE-Mag-16.pdf]]> Notices from Packet Analytics http://www.packetanalytics.com/community/read/5/23/23#msg-23 Wed, 30 Apr 2008 08:56:58 -0500 http://www.packetanalytics.com/community/read/2/14/22#msg-22 benuphoff
For now the best way to try Net/FSE on a Windows machine is to build a VMware image from the ISO download.]]> Net/FSE Installation http://www.packetanalytics.com/community/read/2/14/22#msg-22 Wed, 30 Apr 2008 08:52:43 -0500 http://www.packetanalytics.com/community/read/4/21/21#msg-21 benuphoff Net/FSE Event Types http://www.packetanalytics.com/community/read/4/21/21#msg-21 Wed, 30 Apr 2008 08:50:40 -0500 http://www.packetanalytics.com/community/read/2/14/20#msg-20 oxfortblue Net/FSE Installation http://www.packetanalytics.com/community/read/2/14/20#msg-20 Tue, 18 Mar 2008 17:35:15 -0500 http://www.packetanalytics.com/community/read/5/19/19#msg-19 admin Notices from Packet Analytics http://www.packetanalytics.com/community/read/5/19/19#msg-19 Sun, 27 Jan 2008 23:22:45 -0600 http://www.packetanalytics.com/community/read/4/17/17#msg-17 benuphoff
InMon (http://www.inmon.com) has an excellent collection of sFlow processing tools for UNIX systems. Using InMon's sflowtool, sFlow data streams can be converted into NetFlow datagrams. Once converted, the sFlow data is treated as NetFlow data by Net/FSE. Follow the steps below to configure sflowtools to stream data to Net/FSE:

-- Configuring a NetFlow Sensor --

1. Log in to the Net/FSE web interface as an administrator.

2. From the Configuration tab, click the Add link under Sensors and create a new sensor of type "NetFlow".

3. Click the Add link in the NetFlow Configurations section. Select the sensor you just created and assign an unused UDP port (over 1024).

4. Restart Net/FSE: /etc/init.d/nfse stop ; /etc/init.d/nfse start

-- Setting up sFlow --

1. Log in to the server you will be collecting sFlow data from. This can be the Net/FSE server. If not, the server must be able to connect over the network to the Net/FSE server on the UDP port specified in step #3 above.

2. Download the sflowtools source code from InMon (using wget or such): http://www.inmon.com/bin/sflowtool-3.12.tar.gz

3. tar -xzf sflowtool-3.12.tar.gz

4. cd sflowtool-3.12

5. ./configure
6. make
- If either step 5 or 6 fails you may not have the required build tools (gcc, make, libpcap development files) installed. Install these packages and try again.

7. ./sflowtool -p SFLOW_PORT -c NETFSE_IP -d NETFLOW_PORT
- SFLOW_PORT: the port on which the server will listen for sFlow data streams
- NETFSE_IP: the IP address (or hostname) of the Net/FSE server. Use “localhost” or “127.0.0.1” if running sflowtool on the NetFSE server.
- NETFLOW_PORT: the port the Net/FSE server is configured to collect NetFlow on for the selected sensor (from step #3 under “Configuring a NetFlow Sensor” above)

8. Configure your sFlow-capable devices to send sFlow streams to the server running sflowtools. If you don’t have an sFlow enabled device, you can create sFlow data streams using InMon’s sFlow Agent: http://www.inmon.com/bin/InMon_Agent-5.7.tar.gz.]]> Net/FSE Event Types http://www.packetanalytics.com/community/read/4/17/17#msg-17 Fri, 25 Jan 2008 17:11:10 -0600 http://www.packetanalytics.com/community/read/5/15/15#msg-15 benuphoff Notices from Packet Analytics http://www.packetanalytics.com/community/read/5/15/15#msg-15 Tue, 22 Jan 2008 13:21:42 -0600 http://www.packetanalytics.com/community/read/2/14/14#msg-14 benuphoff
If you have successfully installed Net/FSE on another Linux OS not listed here, please post in the forum. If there is a Linux variety that you would like supported in the future, please contact ben@packetanalytics.com or post to this forum.

Windows support will be explored in the future if user demand is high. Let us know.]]> Net/FSE Installation http://www.packetanalytics.com/community/read/2/14/14#msg-14 Mon, 21 Jan 2008 08:33:25 -0600 http://www.packetanalytics.com/community/read/3/13/13#msg-13 benuphoff
Net/FSE's GUI interface allows you to define sensors (systems that generate events/logs), setup syslog processing of sensor data and create NetFlow collector instances. Start by reading the admin guide (admin.pdf in the download's docs folder). If your questions aren't answered there then please post to this forum.]]> Net/FSE Configuration http://www.packetanalytics.com/community/read/3/13/13#msg-13 Mon, 21 Jan 2008 08:27:42 -0600 http://www.packetanalytics.com/community/read/4/12/12#msg-12 benuphoff Net/FSE Event Types http://www.packetanalytics.com/community/read/4/12/12#msg-12 Mon, 21 Jan 2008 08:23:15 -0600 http://www.packetanalytics.com/community/read/5/11/11#msg-11 admin
We are happy to report that Packet Analytics' version 1.0 of Net/FSE is available for download. Just click the "Free Download" link above.

We look forward to your feedback!

Andy]]> Notices from Packet Analytics http://www.packetanalytics.com/community/read/5/11/11#msg-11 Sun, 13 Jan 2008 22:38:16 -0600 http://www.packetanalytics.com/community/read/1/10/10#msg-10 admin
We are happy to report that Packet Analytics' version 1.0 of Net/FSE is available for download. Just click the "Free Download" link above.

We look forward to your feedback!

Andy]]> General Net/FSE comments http://www.packetanalytics.com/community/read/1/10/10#msg-10 Sat, 12 Jan 2008 23:26:43 -0600 http://www.packetanalytics.com/community/read/5/7/7#msg-7 admin
Welcome to the Packet Analytics User Community! It is important to us that you are an involved member of the community. We want to listen to your input about Net/FSE. Other users in the community want to hear from you as well.

We look forward to your input.

The Packet Analytics Team]]> Notices from Packet Analytics http://www.packetanalytics.com/community/read/5/7/7#msg-7 Fri, 11 Jan 2008 09:59:40 -0600