fprobe鍙傛暟 -n -k

Posted 2020-11-28

鏍囩锛?a href='http://www.mamicode.com/so/1/size' title='size'>size   pca   鍥剧墖   suitable   log   http   淇濈暀   

缃戠粶娴侀噺鍒嗘瀽鍒╁櫒-鍙鍖栫綉缁?netflow銆?銆?鍩虹鍘熺悊
缃戠粶娴侀噺鍒嗘瀽鍒╁櫒-鍙鍖栫綉缁?netflow銆?銆?Cisco NetFlow 宸ヤ綔鍘熺悊浠嬬粛鍙婇厤缃?/a>
缃戠粶娴侀噺鍒嗘瀽鍒╁櫒-鍙鍖栫綉缁?netflow銆?銆?netflow鐗堟湰5鍜岀増鏈?鍖哄埆
缃戠粶娴侀噺鍒嗘瀽鍒╁櫒-鍙鍖栫綉缁?netflow銆?銆?鎺ユ敹鍣╪fdump绠€浠?/a>
缃戠粶娴侀噺鍒嗘瀽鍒╁櫒-鍙鍖栫綉缁?netflow銆?銆?linux涓嬫暟鎹噰闆嗗櫒fprobe
缃戠粶娴侀噺鍒嗘瀽鍒╁櫒-鍙鍖栫綉缁?netflow銆?銆?鐢熶骇缃戞祦閲忕洃鎺ф灦鏋勮璁?/a>
fprobe鍙傛暟 -e
fprobe鍙傛暟 -n -k

璧峰洜锛?/h2>

閫氳繃鎬濈闀滃儚杩囨潵鐨勬暟鎹彲浠ユ垚鍔熻fprobe杞崲鎴恘etflow鏁版嵁鍖咃紝nfdump鍙互灏嗘暟鎹В鏋愭纭紝浣嗘槸閫氳繃鍗庝负浜ゆ崲鏈洪暅鍍忚繃鏉ョ殑鏁版嵁锛岃櫧鐒朵篃鑳借fprobe杞崲鎴恘etflow锛屼絾閫氳繃nfdump瑙ｆ瀽鍑烘潵鐨勬暟鎹槑鏄鹃敊璇紝瑙ｆ瀽鍑烘潵鐨勫叕缃戝湴鍧€閮芥槸鍥藉鐨勬垨鑰呮槸淇濈暀鍦板潃锛屾墍浠ユ垜浠渶瑕佽皟鏁村弬鏁颁娇寰梖rpobe鑳借В鏋愭纭暟鎹€?/p>

缁忚繃锛?/h2>

涓轰簡閬垮厤鐗╃悊鏈嶅姟鍣ㄥ拰鎿嶄綔绯荤粺绛夊鐣屽洜绱犲奖鍝嶏紝鎴戜滑甯︾潃閲嶆柊瀹夎鐨勭瑪璁版湰鍓嶅幓鏈烘埧鍋氭祴璇曪紝鍙戠幇鍜屾満鏋朵笂鐨勭墿鐞嗘湇鍔″櫒瑙ｆ瀽鍑烘潵鐨勬暟鎹槸涓€鏍风殑锛屼簬鏄帓闄や簡鐗╃悊鏈嶅姟鍣ㄥ拰鎿嶄綔绯荤粺绛夊鐣屽洜绱犲奖鍝嶏紝璁ゅ畾浣縡probe鐨勫弬鏁伴棶棰樸€傛敹闆嗕簡閮ㄥ垎鏁版嵁鍖呬俊鎭紝鐢ㄤ簬鍒嗘瀽銆?/p>

鍒嗘瀽杩囩▼锛?/h3>

閫氳繃瀵规瘮鎬濈鍜屽崕涓轰氦鎹㈡満鐨勬姄鍖呮暟鎹紝鍙戠幇鍗庝负浜ゆ崲鏈洪暅鍍忎笅鏉ョ殑鏁版嵁鍖呬腑澶氫簡802.1Q鐨勬暟鎹姤澶淬€?

鍗庝负闀滃儚鏁版嵁鍖?/h4>

鎬濈闀滃儚鏁版嵁鍖?/h4>

鍙傛暟璋冩暣锛?/h2>

鏈€濂界殑鏂瑰紡鏄皟鏁翠氦鎹㈡満鐨勫弬鏁帮紝浣垮緱鏁版嵁鍖呭墺绂籿lan鏍囷紝浣嗗崕涓轰氦鎹㈡満ce5855涓嶆敮鎸佹鍔熻兘銆?/p>

浜庢槸璋冩暣fprobe鐨勫弬鏁般€傞€氳繃man fprobe 锛?
娉細 鎸夌悊璇翠娇鐢?k鍙傛暟灏卞簲璇ヨ兘鎴愬姛锛屼絾鏄湁閮ㄥ垎鐜瀛樺湪闂锛岃繖鏃跺€欓渶瑕佷娇鐢?n鍙傛暟銆傚弽姝ｅ氨杩欎袱涓弬鏁板氨鑳借В鍐抽棶棰樸€?/p>

鍙戠幇-K鍙傛暟

   -K <bytes>
          Link  layer  header size. By default fprobe take this information from libpcap, but sometimes obtained size
          unsuitable for our purpose. It occurs, for example, on trunk interfaces  in  VLAN  enviroment,  where  link
          layer header contain additional VLAN header.
          See EXAMPLES section.

   Capturing from trunk interface:
   fprobe -ieth0 -f"vlan&&ip" -K18 localhost:2055

鍙戠幇-n鍙傛暟

   -n <version>
          NetFlow version for use (1, 5, 7). [default=5]

鏈€缁堝懡浠?/h2>

fprobe -i em1 -e 10 -K18 localhost:9990 -n 7

鎴栬€?
fprobe -i em1 -e 10 -K18 localhost:9990