Using nfSen

Download from official site: http://nfsen.sourceforge.net/

Need these perl modules:

# ubuntu
apt-get install libsocket6-perl libmail-sender-perl libmailtools-perl

# centos
yum install perl-Socket6 perl-MailTools perl-Mail-Sender

Must have nfdump installed first.

Follow README file. Inside extracted source, change to the etc directory and copy the NfSen config file nfsen-dist.conf to nfsen.conf. Edit nfsen.conf according your needs and setup.

Modify nfsen.conf, sample diff:

--- nfsen-dist.conf	2012-01-14 18:13:53.000000000 +0800
+++ nfsen.conf	2012-02-16 15:13:57.580091471 +0800
@@ -18,7 +18,7 @@
 
 #
 # Required for default layout
-$BASEDIR = "/data/nfsen";
+$BASEDIR = "/opt/nfsen";
 
 #
 # Where to install the NfSen binaries
@@ -76,7 +76,7 @@
 
 #
 # nfdump tools path
-$PREFIX  = '/usr/local/bin';
+$PREFIX  = '/usr/bin';
 
 #
 # nfsend communication socket
@@ -92,8 +92,8 @@
 
 # user and group of the web server process
 # All netflow processing will be done with this user
-$WWWUSER  = "www";
-$WWWGROUP = "www";
+$WWWUSER  = "www-data";
+$WWWGROUP = "www-data";
 
 # Receive buffer size for nfcapd - see man page nfcapd(1)
 $BUFFLEN = 200000;
@@ -105,7 +105,8 @@
 # Example:
 # $EXTENSIONS = 'all';
 # $EXTENSIONS = '+3,+4';
-#
+$EXTENSIONS = '+1,+3,+4';
+
 # Directory sub hierarchy layout:
 # Possible layouts:
 #
@@ -160,9 +161,7 @@
 # Ident strings must be 1 to 19 characters long only, containing characters [a-zA-Z0-9_].
 
 %sources = (
-    'upstream1'    => { 'port' => '9995', 'col' => '#0000ff', 'type' => 'netflow' },
-    'peer1'        => { 'port' => '9996', 'IP' => '172.16.17.18' },
-    'peer2'        => { 'port' => '9996', 'IP' => '172.16.17.19' },
+    'alix'    => { 'port' => '9995', 'col' => '#0000ff', 'type' => 'netflow' },
 );
 
 #
@@ -233,7 +232,7 @@
 #
 # Alert module: email alerting:
 # Use this from address 
-$MAIL_FROM   = 'your@from.example.net';
+$MAIL_FROM   = 'root@example.com';
 
 # Use this SMTP server
 $SMTP_SERVER = 'localhost';

Then run:

./install.pl etc/nfsen.conf

Note the lines in nfsen.conf:

%sources = (
  'alix'    => { 'port' => '9995', 'col' => '#0000ff', 'type' => 'netflow' },
...

It means data you received on UDP port 9995 will be labeled as alix in the source selection box.

Use profiles to classify traffic you want to monitor.

The live profile is the default profile after configured the sources in the nfsen.conf

For example, monitor traffic to my web server at 1.2.3.4.

• Start and End time leave blank = Continuous
• Type: shadow

Add one channel for incoming traffic with filter:

proto tcp and dst port 80 and dst ip 1.2.3.4

Add one channel for outgoing traffic with filter:

proto tcp and src port 80 and src ip 1.2.3.4

Better yet, add one channel for monitoring syn flood DoS attack:

proto tcp and dst port 80 and dst ip 1.2.3.4 and flags S and not flags AFRPU