1*f92d9b1aSKristof Provost.\" $OpenBSD: pflow.4,v 1.19 2014/03/29 11:26:03 florian Exp $ 2*f92d9b1aSKristof Provost.\" 3*f92d9b1aSKristof Provost.\" Copyright (c) 2008 Henning Brauer <henning@openbsd.org> 4*f92d9b1aSKristof Provost.\" Copyright (c) 2008 Joerg Goltermann <jg@osn.de> 5*f92d9b1aSKristof Provost.\" 6*f92d9b1aSKristof Provost.\" Permission to use, copy, modify, and distribute this software for any 7*f92d9b1aSKristof Provost.\" purpose with or without fee is hereby granted, provided that the above 8*f92d9b1aSKristof Provost.\" copyright notice and this permission notice appear in all copies. 9*f92d9b1aSKristof Provost.\" 10*f92d9b1aSKristof Provost.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11*f92d9b1aSKristof Provost.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12*f92d9b1aSKristof Provost.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13*f92d9b1aSKristof Provost.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14*f92d9b1aSKristof Provost.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15*f92d9b1aSKristof Provost.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16*f92d9b1aSKristof Provost.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17*f92d9b1aSKristof Provost.\" 18*f92d9b1aSKristof Provost.Dd $Mdocdate: January 08 2024 $ 19*f92d9b1aSKristof Provost.Dt PFLOW 4 20*f92d9b1aSKristof Provost.Os 21*f92d9b1aSKristof Provost.Sh NAME 22*f92d9b1aSKristof Provost.Nm pflow 23*f92d9b1aSKristof Provost.Nd kernel interface for pflow data export 24*f92d9b1aSKristof Provost.Sh SYNOPSIS 25*f92d9b1aSKristof Provost.Cd "pseudo-device pflow" 26*f92d9b1aSKristof Provost.Sh DESCRIPTION 27*f92d9b1aSKristof ProvostThe 28*f92d9b1aSKristof Provost.Nm 29*f92d9b1aSKristof Provostsubsystem exports 30*f92d9b1aSKristof Provost.Nm 31*f92d9b1aSKristof Provostaccounting data from the kernel using 32*f92d9b1aSKristof Provost.Xr udp 4 33*f92d9b1aSKristof Provostpackets. 34*f92d9b1aSKristof Provost.Nm 35*f92d9b1aSKristof Provostis compatible with netflow version 5 and IPFIX (10). 36*f92d9b1aSKristof ProvostThe data is extracted from the 37*f92d9b1aSKristof Provost.Xr pf 4 38*f92d9b1aSKristof Provoststate table. 39*f92d9b1aSKristof Provost.Pp 40*f92d9b1aSKristof ProvostMultiple 41*f92d9b1aSKristof Provost.Nm 42*f92d9b1aSKristof Provostinterfaces can be created at runtime using the 43*f92d9b1aSKristof Provost.Ic pflowctl Ns Ar N Ic -c 44*f92d9b1aSKristof Provostcommand. 45*f92d9b1aSKristof ProvostEach interface must be configured with a flow receiver IP address 46*f92d9b1aSKristof Provostand a flow receiver port number. 47*f92d9b1aSKristof Provost.Pp 48*f92d9b1aSKristof ProvostOnly states created by a rule marked with the 49*f92d9b1aSKristof Provost.Ar pflow 50*f92d9b1aSKristof Provostkeyword are exported by 51*f92d9b1aSKristof Provost.Nm . 52*f92d9b1aSKristof Provost.Pp 53*f92d9b1aSKristof Provost.Nm 54*f92d9b1aSKristof Provostwill attempt to export multiple 55*f92d9b1aSKristof Provost.Nm 56*f92d9b1aSKristof Provostrecords in one 57*f92d9b1aSKristof ProvostUDP packet, but will not hold a record for longer than 30 seconds. 58*f92d9b1aSKristof Provost.Pp 59*f92d9b1aSKristof ProvostEach packet seen on this interface has one header and a variable number of 60*f92d9b1aSKristof Provostflows. 61*f92d9b1aSKristof ProvostThe header indicates the version of the protocol, number of 62*f92d9b1aSKristof Provostflows in the packet, a unique sequence number, system time, and an engine 63*f92d9b1aSKristof ProvostID and type. 64*f92d9b1aSKristof ProvostHeader and flow structs are defined in 65*f92d9b1aSKristof Provost.In net/pflow.h . 66*f92d9b1aSKristof Provost.Pp 67*f92d9b1aSKristof ProvostThe 68*f92d9b1aSKristof Provost.Nm 69*f92d9b1aSKristof Provostsource and destination addresses are controlled by 70*f92d9b1aSKristof Provost.Xr pflowctl 8 . 71*f92d9b1aSKristof Provost.Cm src 72*f92d9b1aSKristof Provostis the sender IP address of the UDP packet which can be used 73*f92d9b1aSKristof Provostto identify the source of the data on the 74*f92d9b1aSKristof Provost.Nm 75*f92d9b1aSKristof Provostcollector. 76*f92d9b1aSKristof Provost.Cm dst 77*f92d9b1aSKristof Provostdefines the collector IP address and the port. 78*f92d9b1aSKristof ProvostThe 79*f92d9b1aSKristof Provost.Cm dst 80*f92d9b1aSKristof ProvostIP address and port must be defined to enable the export of flows. 81*f92d9b1aSKristof Provost.Pp 82*f92d9b1aSKristof ProvostFor example, the following command sets 10.0.0.1 as the source 83*f92d9b1aSKristof Provostand 10.0.0.2:1234 as destination: 84*f92d9b1aSKristof Provost.Bd -literal -offset indent 85*f92d9b1aSKristof Provost# pflowctl -s pflow0 src 10.0.0.1 dst 10.0.0.2:1234 86*f92d9b1aSKristof Provost.Ed 87*f92d9b1aSKristof Provost.Pp 88*f92d9b1aSKristof ProvostThe protocol is set to IPFIX with the following command: 89*f92d9b1aSKristof Provost.Bd -literal -offset indent 90*f92d9b1aSKristof Provost# pflowctl -s pflow0 proto 10 91*f92d9b1aSKristof Provost.Ed 92*f92d9b1aSKristof Provost.Sh SEE ALSO 93*f92d9b1aSKristof Provost.Xr netintro 4 , 94*f92d9b1aSKristof Provost.Xr pf 4 , 95*f92d9b1aSKristof Provost.Xr udp 4 , 96*f92d9b1aSKristof Provost.Xr pf.conf 5 , 97*f92d9b1aSKristof Provost.Xr pflowctl 8 , 98*f92d9b1aSKristof Provost.Xr tcpdump 8 99*f92d9b1aSKristof Provost.Sh STANDARDS 100*f92d9b1aSKristof Provost.Rs 101*f92d9b1aSKristof Provost.%A B. Claise 102*f92d9b1aSKristof Provost.%D January 2008 103*f92d9b1aSKristof Provost.%R RFC 5101 104*f92d9b1aSKristof Provost.%T "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information" 105*f92d9b1aSKristof Provost.Re 106*f92d9b1aSKristof Provost.Sh HISTORY 107*f92d9b1aSKristof ProvostThe 108*f92d9b1aSKristof Provost.Nm 109*f92d9b1aSKristof Provostdevice first appeared in 110*f92d9b1aSKristof Provost.Ox 4.5 111*f92d9b1aSKristof Provostand was imported into 112*f92d9b1aSKristof ProvostFreeBSD 15.0 . 113*f92d9b1aSKristof Provost.Sh BUGS 114*f92d9b1aSKristof ProvostA state created by 115*f92d9b1aSKristof Provost.Xr pfsync 4 116*f92d9b1aSKristof Provostcan have a creation or expiration time before the machine came up. 117*f92d9b1aSKristof ProvostIn this case, 118*f92d9b1aSKristof Provost.Nm 119*f92d9b1aSKristof Provostpretends such flows were created or expired when the machine came up. 120*f92d9b1aSKristof Provost.Pp 121*f92d9b1aSKristof ProvostThe IPFIX implementation is incomplete: 122*f92d9b1aSKristof ProvostThe required transport protocol SCTP is not supported. 123*f92d9b1aSKristof ProvostTransport over TCP and DTLS protected flow export is also not supported. 124