### Install Softflowd Dependencies and Build Source: https://context7.com/irino/softflowd/llms.txt Installs necessary dependencies and builds softflowd from source using autotools. Optional configure flags can customize the build. ```sh # Install dependencies (example: Debian/Ubuntu) sudo apt-get install libpcap-dev autoconf automake # Build autoreconf -if ./configure make sudo make install # Optional configure flags: # --enable-ntopng Enable direct ntopng injection (requires libzmq) # --enable-pthread Enable experimental multithreading # --enable-ifname Export interface name in NetFlow v9/IPFIX records # --with-chrootdir=DIR Set chroot directory (default: /var/empty) # Default installed files: # /usr/sbin/softflowd # /usr/sbin/softflowctl # /var/run/softflowd.pid (runtime PID file) # /var/run/softflowd.ctl (runtime control socket) ``` -------------------------------- ### Configure Flow Tracking and UDP Timeout Source: https://github.com/irino/softflowd/wiki/softflowd Increase the maximum number of concurrent flows tracked and set a specific timeout for UDP flows. This example uses NetFlow v.5. ```bash softflowd -v 5 -i fxp0 -n 10.1.0.2:4432 -m 65536 -t udp=1m30s ``` -------------------------------- ### libpcap Buffer Size (-B) and Capture Length (-C) Source: https://context7.com/irino/softflowd/llms.txt Tune kernel buffer size and packet capture length for performance. A larger buffer helps avoid packet drops on busy interfaces, while snaplen controls the amount of data captured per packet. ```sh softflowd -i eth0 -n 10.1.0.2:9995 -B 10485760 ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 -C 128 ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 -B 16777216 -C 96 ``` -------------------------------- ### Basic Live Capture with NetFlow v5 Export Source: https://context7.com/irino/softflowd/llms.txt Captures traffic on a specified interface and exports NetFlow v5 records to a collector. Includes options for statistics-only mode, foreground execution for debugging, and full debug mode. ```sh # Listen on eth0, export NetFlow v5 to collector at 10.1.0.2:9995 softflowd -i eth0 -n 10.1.0.2:9995 # Listen on eth0, statistics-only mode (no export) softflowd -i eth0 # Run in foreground (no fork), useful for debugging softflowd -d -i eth0 -n 10.1.0.2:9995 # Full debug mode (implies -d and -6, verbose output) softflowd -D -i eth0 -n 10.1.0.2:9995 ``` -------------------------------- ### ntopng Direct Injection (-v ntopng) Source: https://context7.com/irino/softflowd/llms.txt Send flows directly to ntopng via ZeroMQ, bypassing nProbe. Requires `--enable-ntopng` during compilation. ```sh ./configure --enable-ntopng make && sudo make install ``` ```sh softflowd -v ntopng -i eth0 -n "localhost:5556" ``` -------------------------------- ### Select Transport Protocol for Export (-P) Source: https://context7.com/irino/softflowd/llms.txt Choose the transport layer protocol (UDP, TCP, or SCTP) for sending NetFlow/IPFIX packets. ```sh softflowd -i eth0 -n 10.1.0.2:9995 -P udp ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 -P tcp ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 -P sctp ``` -------------------------------- ### Track with Ethernet MAC Addresses (9-tuple) Source: https://context7.com/irino/softflowd/llms.txt Use the -T ether option to track flows using Ethernet MAC addresses for the finest granularity. ```sh softflowd -T ether -i eth0 -n 10.1.0.2:9995 ``` -------------------------------- ### Dump active flows from softflowd Source: https://context7.com/irino/softflowd/llms.txt Print all currently tracked flows to standard output. Specify a non-default control socket using the -c flag. ```sh softflowctl dump-flows ``` ```sh # With non-default socket softflowctl -c /var/run/sfd.ctl.eth0 dump-flows ``` -------------------------------- ### Multiple Export Destinations and Load Balancing Source: https://context7.com/irino/softflowd/llms.txt Exports flows to multiple collectors simultaneously, with options for load balancing. Supports IPv6 collectors and multicast export with TTL. ```sh # Export to two collectors (both receive all flows) softflowd -i eth0 -n 10.1.0.2:9995,10.1.0.3:9995 # Load-balance mode: odd packets → first destination, even → second softflowd -i eth0 -l -n 10.1.0.2:9995,10.1.0.3:9995 # Up to 16 destinations supported softflowd -i eth0 -n 10.1.0.2:9995,10.1.0.3:9995,10.1.0.4:9995 # Export to IPv6 collector (enclose IPv6 address in brackets) softflowd -v 9 -i eth0 -n "[2001:db8::1]:9995" # Multicast export with TTL 64 (NetFlow v9) softflowd -v 9 -i eth0 -n 224.0.1.20:9995 -L 64 ``` -------------------------------- ### Non-promiscuous Mode (-N) and Interface Index (-i if_ndx:iface) Source: https://context7.com/irino/softflowd/llms.txt Control promiscuous mode and specify interface input/output indices for NetFlow records. Multiple instances can run on the same machine by specifying separate PID and control files. ```sh softflowd -N -i eth0 -n 10.1.0.2:9995 ``` ```sh softflowd -i 2:eth0 -n 10.1.0.2:9995 ``` ```sh softflowd -i eth0 -p /var/run/sfd.pid.eth0 -c /var/run/sfd.ctl.eth0 -n 10.1.0.2:9995 softflowd -i eth1 -p /var/run/sfd.pid.eth1 -c /var/run/sfd.ctl.eth1 -n 10.1.0.2:9996 ``` -------------------------------- ### PSAMP Receive Mode (-R) Source: https://context7.com/irino/softflowd/llms.txt Run softflowd as a PSAMP receiver to collect PSAMP data from another softflowd instance and re-export it. ```sh softflowd -v psamp -i eth0 -n 10.1.0.2:5000 ``` ```sh softflowd -R 5000 -v 10 -n 10.1.0.3:9995 ``` -------------------------------- ### View softflowd timeout configuration Source: https://context7.com/irino/softflowd/llms.txt Print the current flow timeout parameters of the running daemon. This command provides insight into how long different types of flows are tracked. ```sh softflowctl timeouts ``` -------------------------------- ### Specify IPFIX Absolute Time Format (-A) Source: https://context7.com/irino/softflowd/llms.txt Set the precision of absolute timestamps in IPFIX (v10) export records to sec, milli, micro, or nano. ```sh softflowd -v 10 -i eth0 -n 10.1.0.2:9995 -A sec ``` ```sh softflowd -v 10 -i eth0 -n 10.1.0.2:9995 -A milli ``` ```sh softflowd -v 10 -i eth0 -n 10.1.0.2:9995 -A micro ``` ```sh softflowd -v 10 -i eth0 -n 10.1.0.2:9995 -A nano ``` -------------------------------- ### Export NetFlow v.5 with Load Balancing Source: https://github.com/irino/softflowd/wiki/softflowd Configure softflowd to listen on a specific interface and export NetFlow v.5 datagrams to multiple collectors with load balancing enabled. Packets are distributed alternately between collectors. ```bash softflowd -i fxp0 -l -n 10.1.0.2:4432,10.1.0.3:4432 ``` -------------------------------- ### Run softflowd in statistics gathering mode Source: https://github.com/irino/softflowd/blob/master/softflowd.html Use this command to run softflowd to listen on a specific interface and collect statistics without exporting NetFlow data. ```bash softflowd -i fxp0 ``` -------------------------------- ### Specify Alternate Control Socket and PID File Locations Source: https://github.com/irino/softflowd/wiki/softflowd Configure softflowd to use custom paths for its control socket and process ID file. This is useful when running multiple instances. ```bash softflowd -i fxp0 -p /var/run/sfd.pid.fxp0 -c /var/run/sfd.ctl.fxp0 ``` -------------------------------- ### Specify NetFlow Export Version Source: https://context7.com/irino/softflowd/llms.txt Selects the NetFlow protocol version for flow export. Supports versions 1, 5, 9, 10 (IPFIX), and psamp. Version 5 is the default. Bidirectional flow records can be enabled for IPFIX. ```sh # NetFlow v1 softflowd -v 1 -i eth0 -n 10.1.0.2:9995 # NetFlow v5 (default) softflowd -v 5 -i eth0 -n 10.1.0.2:9995 # NetFlow v9 (supports IPv6 export) softflowd -v 9 -i eth0 -n 10.1.0.2:9995 # IPFIX (NetFlow v10) softflowd -v 10 -i eth0 -n 10.1.0.2:9995 # PSAMP format softflowd -v psamp -i eth0 -n 10.1.0.2:9995 # IPFIX with bidirectional flow records (RFC 5103) softflowd -v 10 -b -i eth0 -n 10.1.0.2:9995 ``` -------------------------------- ### Softflowd flow tracking levels Source: https://context7.com/irino/softflowd/llms.txt C enum defining constants for different flow tracking granularities, used with the -T option. ```c enum { TRACK_IP_ONLY, TRACK_IP_PROTO, TRACK_IP_PROTO_PORT, TRACK_FULL, TRACK_FULL_VLAN, TRACK_FULL_VLAN_ETHER }; ``` -------------------------------- ### Configure Flow Timeouts (-t) Source: https://context7.com/irino/softflowd/llms.txt Override default expiry timeouts for different flow types using suffixes like s, m, h, d, w. The -t option can be specified multiple times. ```sh softflowd -v 5 -i eth0 -n 10.1.0.2:9995 -m 65536 -t udp=1m30s ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 -t tcp=30m -t expint=30 ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 -t maxlife=0 ``` -------------------------------- ### Specify Exporter IP Address (-e) Source: https://context7.com/irino/softflowd/llms.txt Set the source IP address reported in NetFlow/IPFIX records as the exporter address. Supports both IPv4 and IPv6. ```sh softflowd -v 9 -i eth0 -n 10.1.0.2:9995 -e 192.168.1.1 ``` ```sh softflowd -v 10 -i eth0 -n "[2001:db8::1]:9995" -e 2001:db8::100 ``` -------------------------------- ### Export NetFlow v.5 to Multiple Collectors Source: https://github.com/irino/softflowd/wiki/softflowd Configure softflowd to listen on a specific interface and export NetFlow v.5 datagrams to multiple flow collectors. ```bash softflowd -i fxp0 -n 10.1.0.2:4432,10.1.0.3:4432 ``` -------------------------------- ### Shut down softflowd daemon Source: https://context7.com/irino/softflowd/llms.txt Gracefully shut down softflowd with flow export or force-quit without export. The `kill -TERM` command can be used as an equivalent to graceful shutdown. ```sh # Graceful shutdown: expire all flows, send export records, then exit softflowctl shutdown ``` ```sh # Immediate exit: no flow processing or export softflowctl exit ``` ```sh # Equivalent to softflowctl shutdown: kill -TERM $(cat /var/run/softflowd.pid) ``` ```sh # Equivalent to softflowctl exit (no export on quit): softflowctl delete-all softflowctl exit ``` -------------------------------- ### Query softflowd statistics Source: https://context7.com/irino/softflowd/llms.txt Retrieve accumulated statistics from a running softflowd daemon. Use the -c flag to specify a non-default control socket. ```sh # Query the default control socket softflowctl statistics ``` ```sh # Query a non-default socket (e.g., second instance) softflowctl -c /var/run/sfd.ctl.eth1 statistics ``` -------------------------------- ### Flow Sampling (-s) Source: https://context7.com/irino/softflowd/llms.txt Export only a statistical sample of flows by specifying a denominator. When using NetFlow v9, softflowd automatically sends option templates describing the sampling rate. ```sh softflowd -i eth0 -n 10.1.0.2:9995 -s 100 ``` ```sh softflowd -v 9 -i eth0 -n 10.1.0.2:9995 -s 10 ``` -------------------------------- ### Read Flow Data from pcap Capture Files Source: https://context7.com/irino/softflowd/llms.txt Processes a stored packet capture file (`pcap`) to generate flow records. Options include adjusting flow timestamps and performing statistics-only analysis. Can be combined with `tcpdump` for capturing. ```sh # Process a tcpdump capture file, export to collector softflowd -r /tmp/capture.pcap -n 10.1.0.2:9995 # Adjust flow timestamps to match original capture times softflowd -r /tmp/capture.pcap -a -n 10.1.0.2:9995 # Statistics-only mode from pcap file (no export) softflowd -r /tmp/capture.pcap # Capture a file with tcpdump, then process with softflowd tcpdump -w /tmp/capture.pcap -i eth0 'port 80' softflowd -v 9 -r /tmp/capture.pcap -n 10.1.0.2:9995 # softflowd exits automatically after processing and prints summary statistics ``` -------------------------------- ### Export NetFlow v.5 to a Single Collector Source: https://github.com/irino/softflowd/wiki/softflowd Configure softflowd to listen on a specific interface and export NetFlow v.5 datagrams to a single flow collector. ```bash softflowd -i fxp0 -n 10.1.0.2:4432 ``` -------------------------------- ### BPF Packet Filtering Source: https://context7.com/irino/softflowd/llms.txt Apply a Berkeley Packet Filter (BPF) expression to ignore specific traffic and capture only desired packets. ```sh softflowd -i eth0 -n 10.1.0.2:9995 tcp ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 not host 192.168.1.1 ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 net 10.0.0.0/8 ``` ```sh softflowd -i eth0 -n 10.1.0.2:9995 "tcp and port 80" ``` -------------------------------- ### Adjust softflowd debug level Source: https://context7.com/irino/softflowd/llms.txt Dynamically increase or decrease the daemon's logging verbosity at runtime using simple commands. ```sh # Increase debug verbosity softflowctl debug+ ``` ```sh # Decrease debug verbosity softflowctl debug- ``` -------------------------------- ### MPLS Label Export (-x) Source: https://context7.com/irino/softflowd/llms.txt Decode and export MPLS shim label headers from captured packets, specifying the maximum number of labels to export per flow. ```sh softflowd -v 10 -i eth0 -n 10.1.0.2:9995 -x 3 ``` ```sh softflowd -v 10 -i eth0 -n 10.1.0.2:9995 -x 10 ``` -------------------------------- ### Control softflowd data collection Source: https://context7.com/irino/softflowd/llms.txt Pause and resume network packet capture without stopping the daemon. Flows in memory are retained when capture is stopped. ```sh # Stop capturing packets (flows in memory are retained) softflowctl stop-gather ``` ```sh # Resume capturing packets softflowctl start-gather ``` -------------------------------- ### Softflowd default timeout values Source: https://context7.com/irino/softflowd/llms.txt C defines for default timeout values used by softflowd, specifying durations for various flow states and parameters. ```c #define DEFAULT_TCP_TIMEOUT 3600 /* 1 hour */ #define DEFAULT_TCP_RST_TIMEOUT 120 /* 2 min */ #define DEFAULT_TCP_FIN_TIMEOUT 300 /* 5 min */ #define DEFAULT_UDP_TIMEOUT 300 /* 5 min */ #define DEFAULT_ICMP_TIMEOUT 300 /* 5 min */ #define DEFAULT_GENERAL_TIMEOUT 3600 /* 1 hour */ #define DEFAULT_MAXIMUM_LIFETIME 604800 /* 1 week */ #define DEFAULT_EXPIRY_INTERVAL 60 /* 1 min */ #define DEFAULT_MAX_FLOWS 8192 /* ~800 KB */ #define SOFTFLOWD_MAX_DESTINATIONS 16 /* max export targets */ ``` -------------------------------- ### Control Flow Tracking Level Source: https://context7.com/irino/softflowd/llms.txt Adjusts the attributes used to distinguish flows, ranging from IP addresses only to a full 7-tuple including VLAN ID. The default is the full 5-tuple. ```sh # Track by src/dst IP only (coarsest, maximum consolidation) softflowd -T ip -i eth0 -n 10.1.0.2:9995 # Track by src/dst IP + protocol (3-tuple) softflowd -T proto -i eth0 -n 10.1.0.2:9995 # Track full 5-tuple: src/dst IP + port + protocol (default) softflowd -T full -i eth0 -n 10.1.0.2:9995 # Track with VLAN ID (7-tuple) softflowd -T vlan -i eth0 -n 10.1.0.2:9995 ``` -------------------------------- ### FLOW Structure Definition Source: https://context7.com/irino/softflowd/llms.txt Defines the structure for a per-flow record, including sequence ID, timestamps, byte and packet counts, network addresses, ports, TCP flags, and other flow-related metadata. This structure is fundamental for understanding the data captured by softflowd. ```c struct FLOW { u_int64_t flow_seq; struct timeval flow_start; struct timeval flow_last; u_int32_t octets[2]; u_int32_t packets[2]; int af; union { struct in_addr v4; struct in6_addr v6; } addr[2]; u_int16_t port[2]; u_int8_t tcp_flags[2]; u_int8_t tos[2]; u_int16_t vlanid[2]; uint8_t ethermac[2][6]; u_int8_t protocol; u_int8_t flowEndReason; u_int32_t mplsLabelStackDepth; u_int32_t mplsLabels[10]; }; ``` -------------------------------- ### Export NetFlow v.9 to Multicast Group Source: https://github.com/irino/softflowd/wiki/softflowd Configure softflowd to export NetFlow v.9 flows to a multicast group with a specified Time-To-Live (TTL) for the export datagrams. ```bash softflowd -v 9 -i fxp0 -n 224.0.1.20:4432 -L 64 ``` -------------------------------- ### Expire and delete softflowd flows Source: https://context7.com/irino/softflowd/llms.txt Force immediate expiry (with export) or silent deletion of all tracked flows. The -c flag can be used to target a specific control socket. ```sh # Expire all flows immediately, sending NetFlow records to configured collector softflowctl expire-all ``` ```sh # Delete all flows silently (no export) softflowctl delete-all ``` ```sh # With non-default socket softflowctl -c /var/run/sfd.ctl.eth0 expire-all ``` -------------------------------- ### Resend NetFlow v9 template Source: https://context7.com/irino/softflowd/llms.txt Force softflowd to retransmit the NetFlow v9 template record to the collector immediately. This is useful when a collector restarts and loses its cached template. This command has no effect on other NetFlow versions or IPFIX. ```sh # Useful when a collector restarts and loses its cached template softflowctl send-template ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.