Hardware Installation

Essentially every stock PC should be able to host the probe, provided its power supply has enough spare capacity. Good fans are also recommended.

The probe consists of a motherboard and an interface card together forming a “sandwich” that fits into a single PCI slot. Two hardware variants are currently available:

1. The older version uses the COMBO6 motherboard together with a Gigabit Ethernet interface card, which can be either COMBO-4MTX with metallic ports or COMBO-4SFP with cages for SFP transceivers.
2. The new version combines the COMBO6X motherboard with the COMBO-4SFPRO interface card.

In the first case, COMBO6 motherboard has the short connector for the 32-bit/33 MHz PCI bus. The second variant with COMBO6X supports both 64/66 PCI and PCI-X.

Use the following command to check that the probe hardware has been correctly recognised as a PCI device:

$ lspci -d 18ec:
0000:02:02.0 Ethernet controller: Cesnet, z.s.p.o. COMBO6 (rev 01)

Don't be alarmed if you see something like Unknown device 18ec:c006. It only means your database of PCI vendors/devices in the /var/lib/misc/pci.ids file is not up-to-date. You can get the newest version from the Linux PCI ID Repository.

In most cases you will also want to add and configure another (standard) network adapter, to be able to connect remotely to the host computer and/or send flow records to a remote collector.

Network connection

FlowMon probe acts as a full-duplex GE repeater between ports 0 and 1 of the interface card. Port 0 is the bottommost one closest to the PCI connector and port 1 is next to it. Note that only Gigabit Ethernet is currently supported. In particular, plain Ethernet or Fast Ethernet will not work!

The repeater function of the probe is completely independent of the flow-processing firmware and software, so it should survive even reboots of the host computer (not a power outage though). If you don't want to insert the probe directly into the monitored link, you can also connect port 0 or 1 to a router or switch port that receives traffic mirrored from other interfaces. The other FlowMon port can then be connected, for example, to a network tester.

Software prerequisites

Control software for the NetFlow probe and the exporter run on Linux. We have tested it mainly on Debian, Ubuntu and Fedora but any other reasonably recent Linux distribution should be fine. You will have to compile all the software, so the C development environment is required. As a compiler, we recommend to use GNU C Compiler of major version 2 or 3. Version 4 may work too, but in that case we cannot currently provide any support.

To learn about the installed version of GCC, run the following command:

$ gcc --version

In its output, major version number is the leftmost digit.

You will also need the autoconf and automake programs. If they are not already installed, they should be available as add-on packages for your Linux distribution.

The driver module should work fine with recent releases of the Linux kernel in both 2.4 and 2.6 series. It is important to compile the module with exactly the same GCC version as was used for the kernel proper. Note that some distributions provide GCC v4 but still rely on an older version for compiling the kernel. For example, on Ubuntu 5.10 you have to install the gcc-3.3-base package separately, at least for compiling the kernel modules.

Downloading the FlowMon package

In order to download the package with the necessary NetFlow firmware and software, you have to fill in the registration form. We recommend that you check the box “Send info about changes?” in order to stay informed about new versions of the firmware and other changes.

After your request is approved, a key will be sent to you. Use this key at the member login page, click on NetFlow package and then download the tarball file NETFLOW_XX_YY_ZZ.tgz. In general, you should always use the most recent version as the older versions may not have all features described in the documentation and/or contain bugs.

Compiling and installing

These instructions assume you are going to install the firmware and software to your system directories. Alternatively, you can run everything from the build tree without installation. For the latter option, follow the instructions contained in the README file.

Now, unpack the tarball in any convenient location by running

$ tar xvzf NETFLOW_XX_YY_ZZ.tgz

(replace XX_YY_ZZ with the chosen version number such as 01_04_02), go to the NETFLOW_XX_YY_ZZ/base directory and compile everything by running

$ ./pkgtool --build --prefix=/usr/local

The --prefix argument determines the target directory where the software will be installed. Note that FlowMon firmware is always installed in the /usr/local/mcs independently of the prefix setting.

Then install everything by running the following command as root:

# ./pkgtool --install

Post-installation steps

1. Depending on the chosen prefix, you may need to append the <prefix>/bin directory to the PATH environment variable. For our default /usr/local prefix this is usually not necessary.

2. Next, the dynamic loader must be told about new libraries. To do so, append a line with <prefix>/lib to the file /etc/ld.so.conf (if it is not already there) and run

   # ldconfig -v
   

   In its output you should see two new links to dynamic libraries, something like

   libcsflow.so.0 -> libcsflow.so.0.1.0
   libcombo.so.0 -> libcombo.so.0.1.0
   

3. Create necessary device files by running the following script as root:

   # sys_sw/drivers/linux/flowdevices
   

   The FlowMon software need not be run with root privileges. You can run it any user with read and write access to the device files. For example, you can create a new group, say combo-rw, add that user to this group and change the file group ownership and permissions as follows:

   # chgrp combo-rw /dev/combosix/0 /dev/scampi/0
   # chmod 664 /dev/combosix/0 /dev/scampi/0
   

   NOTE: For systems that create the device files on the fly at every system boot via udev, read udev instructions

4. Arrange the kernel modules to be loaded automatically at system boot. On most Linux distribution, this amounts to writing the following entries to the /etc/modules:

   combo6core
   combo6
   scampi
   netflow-ph1
   

Reporting bugs, support

If you encounter any problems during compilation and installation, please report them to our bug tracking system.

We also strongly recommend that you join our mailing list netflow@liberouter.org. To subscribe, go to this page. Feel free to send in your questions, comments or suggestions, our developers will be happy to answer them.