1NFCAPD(1) BSD General Commands Manual NFCAPD(1)
3
5 nfcapd — flow collector for netflow version v1, v5/v7 v9 and ipfix
6
8 nfcapd -w flowdir [-C config] [-z] [-y] [-j] [-D] [-u userid]
9 [-g groupid] [-S num] [-t interval] [-P pidfile] [-p port]
10 [-I ident] [-b bindhost] [-4] [-6] [-j mcastgroup] [-R repeater]
11 [-B buffsize] [-n sourceparam] [-M multiflowdir] [-s rate]
12 [-i metricrate] [-m metricpath] [-e] [-x command] [-E] [-v] [-V]
13
15 nfcapd reads netflow data from the network and stores the records into
16 binary formated files. It accepts netflow v1, v5/v7, v9 and ipfix trans‐
17 parently. It is mostly compatible with a lot of other flow implementa‐
18 tions such as cflow, jflow, pflow and accepts a wide range of exporters
19 including CISCO Flexible Netflow (FNF), ASA firewalls and NAT devices for
20 event logging. It has also support for a wide range of different vendors
21 and their implementation of netflow, such as Juniper, VMware, PaloAlto
22 devices and yaf. Sflow is a different technology. nfcapd supports a
23 large number of netflow v9 and ipfix elements according to the IANA as‐
24 signments.
25 If you want to collect sflow data, please have a look at sfcapd which is
27 also part of the nfdump tools.
28 nfcapd also accepts pre-processed records from its companion collector
30 nfpcapd. nfcapd safes the flows in an output file, which is automati‐
31 cally rotated at a given interval - typically every 5min. These rotated
32 output files are stored in the flowdir directory and are organized by
33 timestamps. The output files are named according to the time interval in
34 the following format: nfcapd.YYYYMMddhhmm e.g. nfcapd.202207110845 which
35 contains flow data from July 11th 2022 08:45 onwards. If the rotation in‐
36 terval is set to a time, smaller then 60s, the naming extends to seconds
37 e.g. nfcapd.20220711084510.
38 nfcapd can run in auto-expire mode -e , which automatically expires old
40 flow files, at the end of every rotation interval. nfexpire(1) explains
41 in more details how to setup flow expiration.
42 nfcapd can run any given command -x or shell script at the end of each
44 rotation interval.
45 nfcapd can send universal flow metric information about the collected
47 flow data (flow summary) to a UNIX socket. Programms, such as nfinflux
48 or nfexporter may be used to send the metric information to an InfluxDB
49 or to a Prometheus monitoring system.
50 The options are as follows:
52 -w flowdir
54 Set the flow directory to store the output files. If a sub hier‐
55 archy is specified with -S the final directory is concatenated to
56 flowdir/subdir.
57 -C config
59 Reads additional configuration parameters from config file.
60 nfcapd tries to read the config file from the install default
61 path $prefix/etc/ which may be overwritten by the environment
62 variable NFCONF , which again is overwritten by this option -C.
63 If -C none is specified, then no config file is read, even if
64 found in the search path.
65 -p portnum
67 Set the port number to listen. Default port is 9995
68 -b bindhost
70 Specifies the hostname/IPv4/IPv6 address to bind for listening.
71 This can be an IP address or a hostname, resolving to a local IP
72 address.
73 -4 Forces nfcapd to listen on IPv4 addresses only. Can be used to‐
75 gether with -b if a hostname has IPv4 and IPv6 addresses.
76 -6 Forces nfcapd to listen on IPv6 addresses only. Can be used to‐
78 gether with -b if a hostname has IPv4 and IPv6 addresses.
79 -J mcastgroup
81 Join the specified IPv4 or IPv6 multicast group for listening.
82 -R host[/port]
84 Enables the packet repeater. All incoming packets are sent addi‐
85 tionally to another host and port. host is either a valid
86 IPv4/IPv6 address, or a symbolic hostname, which resolves to a
87 valid IP address. port may be omitted and defaults to 9995.
88 Note: As IPv4/IPv6 are accepted the host/port separator is '/'.
89 Up to 8 additional repeaters my be defined. Use this methode to
90 daisy chain collectors.
91 -I ident
93 Sets ident as identification string for the current source. This
94 string is written into the output file to identify the source.
95 Default is 'none'. If you have multiple sources, see option -n
96 below.
97 -n ident,IP,flowdir
99 Configures a netflow source identified by the string ident, IP
100 flowdir If you have multiple sources per collector, add multiple
101 -n options. All exporters send the flows to the same port -p. Do
102 not mix single source configuration -I with multiple -n options.
103 -M flowdir
105 Set the flow directory for dynamic allocated exporters. New ex‐
106 porters are dynamically added when sending data. All exporters
107 send netflow data to the same port and IP. For each dynamically
108 added source, a new sub directory is created under flowdir with
109 the name of the IP address of the exporter. All '.' and ':" in IP
110 addresses are replaced be '-'. -D Set daemon mode: fork to back‐
111 ground and detach from terminal. nfcapd terminates on signal
112 TERM, INT or HUP.
113 -P pidfile
115 Writes the running process ID into pidfilw. Use this option to
116 integrate nfcapd in start/stop files.
117 -u userid
119 Drop privileges of running process to user userid. nfcapd needs
120 to be started as user root.
121 -g groupid
123 Drop privileges of running process to group groupid. nfcapd
124 needs to be started as user root.
125 -B bufflen
127 Sets the network socket input buffer to bufflen bytes. For high
128 volume traffic it is recommended to raise this value to typically
129 > 100k, otherwise you risk to lose packets. The default is OS
130 (and kernel) dependent.
131 -S num Adds an additional directory sub hierarchy to store the data
133 files. The default is 0, no sub hierarchy, which means all files
134 go directly into flowdir. The flowdir is concatenated with the
135 specified sub hierarchy format to create the final data direc‐
136 tory. The following hierarchies are defined:
137 0 default no hierarchy levels
138 1 %Y/%m/%d year/month/day
139 2 %Y/%m/%d/%H year/month/day/hour
140 3 %Y/%W/%u year/week_of_year/day_of_week
141 4 %Y/%W/%u/%H year/week_of_year/day_of_week/hour
142 5 %Y/%j year/day-of-year
143 6 %Y/%j/%H year/day-of-year/hour
144 7 %Y-%m-%d year-month-day
145 8 %Y-%m-%d/%H year-month-day/hour
146 -t interval
148 Sets the time interval in seconds to rotate files. The default
149 value is 300s ( 5min ). The smallest available interval is 2s.
150 -s rate
152 Apply sampling rate rate to all netflow records, unless the sam‐
153 pling rate is announced by the exporting device. In that case
154 the announced sampling rate is applied. If rate is negative, this
155 will hard overwrite any device specific announced sampling rates.
156 The sampling rate is used to multiply the number of packets and
157 bytes in a record. Please note, this may vary from other volume
158 counters such as SNMP etc.
159 -z Compress flow files with LZO1X-1 compression. Fastest compres‐
161 sion.
162 -y Compress flow files with LZ4 compression. Fast and efficient.
164 -j Compress flow files with bz2 compression. Slow but most effi‐
166 cient. It is not recommended to use bz2 in a real time capturing.
167 -e Sets auto-expire mode. At the end of every rotate interval -t
169 nfcapd runs an expire cycle to delete files according to max
170 lifetime and max filesize as defined by nfexpire(1)
171 -x command
173 At the end of every -t interval and after the file rotate has
174 completed, nfcapd runs the command command. The string for
175 command may contain the following place holders, which are ex‐
176 panded bevore running:
177 %f File name of new data file inluding any sub hierarchy.
178 %d Top flowdir. The full path of the new file is: %d/%f
179 %t Time slot string in ISO format e.g. 201107110845.
180 %u Time slot string in UNIX time format.
181 %i Identification string ident string supplied by -I
182 -m metricpath
184 Enables the flow metric exporter. Flow metric information is sent
185 to the UNIX socket metricpath at the rate specified by -i This
186 option may by used to export flow metric information to other
187 systems such as InfluxDB or Prometheus. Please note: The flow
188 metric does not include the full record. Only the flow statistics
189 is sent.
190 -i metricrate
192 Sets the interval for the flow metric exporter. This interval may
193 be different from the file rotation interval t and is therefore
194 independant from file rotation.
195 -v Increase verbose level by 1. The verbose level may be increased
197 for debugging purpose up to 3.
198 -E Equal to -v -v -v. Print netflow records in block format to std‐
200 out. Please note, that not all elements are printed, which are
201 available in the flow record. To inspect all elements, use nfdump
202 -o raw This option is for debugging purpose only, to verify if
203 incoming netflow data is processed correctly.
204 -V Print nfcapd version and exit.
206 -h Print help text on stdout with all options and exit.
208
210 nfcapd returns 0 on success and 255 if initialization failed.
211
213 https://www.iana.org/assignments/ipfix/ipfix.xhtml
214 https://www.cisco.com/en/US/technologies/tk648/tk362/technolo‐
216 gies_white_paper09186a00800a3db9.html
217 nfdump(1) nfpcapd(1) sfcapd(1)
219
221 No software without bugs! Please report any bugs back to me.
222BSD February 6, 2023 BSD