Release of the Netflow/IPFIX collector Xenoeye 23.11 has been published, allowing the collection of traffic flow statistics from various network devices transmitted using Netflow v5, v9, and IPFIX protocols, as well as processing data, generating reports, and creating graphs. The project's core is written in C, and the code is distributed under the ISC license.
The collector aggregates network traffic based on selected fields and exports data to PostgreSQL. Reports, graphs (using gnuplot, Python scripts + Matplotlib), or dashboards in Grafana can be created from this data. Additionally, the collector can run custom scripts when thresholds are exceeded. Moving averages are used to calculate traffic speed. A sample Telegram bot script is included with the collector, which can notify the messenger when speed exceeds certain thresholds.
Förändringar i den nya versionen:
- The ability to use GeoIP via ipapi databases has been added. Using GeoIP functions, geo-monitoring objects can be created (for example, highlighting all traffic from Russia in a separate monitoring object) and data can be exported broken down by GeoIP. The collector supports granularity by countries, regions, and cities. Additionally, longitude and latitude can be obtained from the IP address (though it is important to understand that this works very approximately).
- For routers that cannot export autonomous system numbers in Netflow/IPFIX, there is the option to obtain these numbers and their textual descriptions using ip-location-db databases. Similarly to GeoIP, separate monitoring objects can be created that include traffic of selected AS or export the names of autonomous systems to the database.
- Traffic classification by netflow fields has been added. The collector can classify monitoring objects using certain fields (TCP flags, ports, packet sizes).
- A console utility xegeoq has been added, which allows obtaining GeoIP information and AS information from IP addresses using local databases.
Källa: opennet.ru
