{"id":15286512,"url":"https://github.com/javadmohebbi/nfcollector","last_synced_at":"2025-05-07T03:46:36.940Z","repository":{"id":36809644,"uuid":"227985577","full_name":"javadmohebbi/nfCollector","owner":"javadmohebbi","description":"Collects Netflow version 1, 5, 6, 7, 9 \u0026 IPFIX \u0026 stores them on InfluxData time-series DB (InfluxDB)","archived":false,"fork":false,"pushed_at":"2021-04-04T03:16:02.000Z","size":101525,"stargazers_count":45,"open_issues_count":1,"forks_count":11,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-05-07T03:46:24.227Z","etag":null,"topics":["exporting-traffics","grafana","grafana-dashboard","influxdata","influxdb","ipfix","netflow-collector","netflow-dumper","netflow-traffic"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/javadmohebbi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-12-14T07:46:23.000Z","updated_at":"2025-02-27T20:00:13.000Z","dependencies_parsed_at":"2022-07-28T22:49:30.309Z","dependency_job_id":null,"html_url":"https://github.com/javadmohebbi/nfCollector","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/javadmohebbi%2FnfCollector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/javadmohebbi%2FnfCollector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/javadmohebbi%2FnfCollector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/javadmohebbi%2FnfCollector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/javadmohebbi","download_url":"https://codeload.github.com/javadmohebbi/nfCollector/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252810275,"owners_count":21807759,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["exporting-traffics","grafana","grafana-dashboard","influxdata","influxdb","ipfix","netflow-collector","netflow-dumper","netflow-traffic"],"created_at":"2024-09-30T15:15:19.313Z","updated_at":"2025-05-07T03:46:36.918Z","avatar_url":"https://github.com/javadmohebbi.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# END OF LIFE NOTE\n**THIS REPO IS DEPRECATED \u0026 NO PATCH NOR UPDATE WILL BE PROVIDED IN THE FUTURE. TO UPDATE TO THE LATEST VERSION, PLEASE WATCH THIS REPO [goNfCollector](https://github.com/javadmohebbi/goNfCollector)**\n\n\n# Netflow Collector v0.0.9\n**NFCOL** Collects Netflow version 1, 5, 6, 7, 9 \u0026 IPFIX \u0026 stores them on **InfluxData** time-series DB (InfluxDB)\n\n\n## Features\nAs I develop this tool for my personal usage at first step, It has small set of features:\n\n- **Collect all available versions of Netflow**\n  - **YAML** config file which helps you configure the whole application from a single file\n  - Thanks to [tehmaze](https://github.com/tehmaze/netflow), We are using this repo to decode Netflow traffics \u0026 able to decode 1, 5, 6, 7, 9 \u0026 IPFIX protocols.\n  - You can forward **decoded** Netflow packets to another hosts by enabling **Packet Forwarders** in **nfc.yaml** config file\n    - In addition to packet forwarder, **nfc-dump** is a client for forwarded packets to print a nice tabular output. Also this tool can filter incomming packets according to the provided arguments.\n  - Exporting traffics to **InfluxDB** time-series database.\n    - To enable this feature you need to configure **nfc.yaml** config file\n    - Also, It can provide you a GEO Location information for the SOURCE \u0026 DESTINATION IP Addresses (both IPv4 \u0026 IPv6).\n      - To get more information about IP2Location tool you can read this GITHUB Repo. README file [IP2Location](https://github.com/javadmohebbi/IP2Location)\n\n\n## Usage\nIn order to use this tool you can download the compiled binaries or you can compile it for yourself.\nYou can download the compiled versions from the further links:\n\n### Download Binaries:\n  - **Linux AMD64**:\n    - *nfcol*: [Download Linux AMD64 Binaries](https://github.com/javadmohebbi/nfCollector/raw/master/dist/linux/amd64/nfcol)\n    - *nfcol-dump*: [Download Linux AMD64 Binaries](https://github.com/javadmohebbi/nfCollector/raw/master/dist/linux/amd64/nfcol-dump)\n  - **Windows AMD64**:\n    - *nfcol.exe*: [Download Windows AMD64 Binaries](https://github.com/javadmohebbi/nfCollector/raw/master/dist/windows/amd64/nfcol.exe)\n    - *nfcol-dump.exe*: [Download Windows AMD64 Binaries](https://github.com/javadmohebbi/nfCollector/raw/master/dist/windows/amd64/nfcol-dump.exe)\n  - **MacOS AMD64**:\n    - *nfcol*: [Download MacOS AMD64 Binaries](https://github.com/javadmohebbi/nfCollector/raw/master/dist/darwin/amd64/nfcol)\n    - *nfcol-dump*: [Download MacOS AMD64 Binaries](https://github.com/javadmohebbi/nfCollector/raw/master/dist/darwin/amd64/nfcol-dump)\n\n\n\n### Download Installation Packages\nCurrently I have just created a DEB package. I will provide RPM and MSI packages here soon ;-)\n\n  - [Debian (deb) package for AMD64 bit systems](https://github.com/javadmohebbi/nfCollector/raw/master/dist/packages/amd64/deb/nfcol_0.0.9-amd64.deb)\n    - To install this package run the command ```sudo dpkg -i nfcol_0.0.9-amd64.deb```\n      - It will install nfcol, nfcol-dump and ip2location and will create a system service **nfcol.service**. Also it will download the latest IP2Location Lite DB from the Internet\n      - Once Installation has completed, You can check the service status using ```sudo service nfcol status```       \n\n\n\n## Prepare InfluxDB\nIf you want to export Netflow traffics to **InfluxDB** database you must install it. currently we support version 1.x (max version is 1.7)\n- You can get InfluxDB installtion file from [This Link](https://portal.influxdata.com/downloads/)\n- ***InfluxData recommends you to install InfluxDB on SSD*** and since we are going to store many metrics, SSD disk is recommended for better performance.\n- After installing InfluxDB you can create a DB using this command: ```CREATE DATABASE \"netflowDB\" WITH DURATION 10d REPLICATION 1 SHARD DURATION 1h NAME \"nfc\"```\n\n\n### Configuration\nTo config **nfcol** you need to provide configuration file in **yaml** format. ```*nix``` users must place this file in ```/etc/nfcol/nfc.yaml``` \u0026 ```windows``` users must place it in ```%ProgramFiles%\\Netflow-Collector\\nfc.yaml```\n***If you use installtion packages, It will create it for you automatically***\n\nYour ```nfc.yaml``` file must be look like this sample:\n```\n# # # # # # # # # # # # # # # # # #\n#       Netflow Collector         #\n#         Configuration           #\n# # # # # # # # # # # # # # # # # #\nserver:\n  # Listen Address\n  address: 0.0.0.0\n\n  # Listen UDP Port\n  port: 6859\n\n  # If true, nfc will write flow data into stdout\n  dump: false\n\n  # Activate forwarder\n  forwarder: true\n\n  # Host to forward - Can be separated by ; (semi-colon) eg: 127.0.0.1;192.168.100.1\n  forwarderHost: 127.0.0.1\n\n  # Forwarder UDP Port\n  forwarderPort: 7161\n\n# # # # # # # # # # # # # # # # # #\n#    IP2Location Configuration    #\n# # # # # # # # # # # # # # # # # #\nip2location:\n  # IP2Location command path\n  cmd: /usr/local/bin/ip2location\n\n  # Path to Local GEO Database. Read more at:\n  # https://github.com/javadmohebbi/IP2Location#local-database-format\n  local: /etc/ip2location/local.csv\n\n# # # # # # # # # # # # # # # # # #\n#     Exporter Configuration      #\n# # # # # # # # # # # # # # # # # #\nexporter:\n  # Enable if it's true\n  enable: false\n\n  # Currently Only InfluxDB (1.x) supported\n  type: influxdb\n\n\n# # # # # # # # # # # # # # # # # #\n#     InfluxDB Configuration      #\n# # # # # # # # # # # # # # # # # #\ninfluxDB:\n  # InfluxDB Host\n  host: 127.0.0.1\n\n  # InfluxDB Port\n  port: 8086\n\n  # InfluxDB Username. Can be null\n  username: #user\n\n  # InfluxDB Password. Can be null\n  password: #secret\n\n  # InfluxDB Database\n  # InfluxDB command example for creating database:\n  #       CREATE DATABASE \"netflowDB\" WITH DURATION 10d REPLICATION 1 SHARD DURATION 1h NAME \"nfc\"\n  database: netflowDB\n\n  # Temp Dir for InfluxDB Metrics. MUST be ended with / (Linux) or \\ (Windows)\n  tmpDir: /tmp/nfcol/\n\n\n# # # # # # # # # # # # # # # # # #\n#          Measurements           #\n# # # # # # # # # # # # # # # # # #\nmeasurements:\n  # Netflow Summary Measurement Name\n  summaryProto: sum_proto\n\n  # Netflow GEO Summary Measurement Name\n  summaryProtoGeo: sum_proto_geo\n```\n\n\n### IP2Location\nIf you want to use GEO location tool, you need to read it's usage at [IP2Location Github Repositories](https://github.com/javadmohebbi/IP2Location)\n\n\n\n## Command line options\nHere is the command line options for all binaries:\n### nfcol command line options\n```\n  -addr string\n        Listen IP address\n  -debug string\n        It will Print debug info if the value is 'true' and 'false' for nothing\n  -dump string\n        It will Print flow record if the value is 'true' and 'false' for nothing\n  -port string\n        Listen port\n  -v    Print Version \u0026 exit.\n```\n\n- **addr**: Listen address for Netflow Collector tool. If nothing will be provided it will read it from **nfc.yaml** file\n- **port**: Listen port for Netflow Collector tool. If nothing will be provided it will read it from **nfc.yaml** file\n- **debug**: Enable debugging mode \u0026 provide more information about everything\n- **dump**: Disable exporting \u0026 dump netflow traffics to Standard Output\n- **h**: Show help and exit\n- **v**: Print version and exit\n\n\n### nfcol-dump command line options\nThis tool can connect to nfcol tools \u0026 **Filter** and **Print** Netflow Traffic to the standard output (Terminal, CMD, Powershell)\nAlmost all of options starts with **-flt** \u0026 accepts ***wildcards***.\n```\n  -addr string\n        Listen IP address - Default 127.0.0.1\n  -flt-dst-ip string\n        Filter Destination IP. eg: 192.168.1.1, 192.168.1.* (default \"*\")\n  -flt-dst-port string\n        Filter Destination Port. eg: 80, 433, 100-250 (default \"*\")\n\n  -flt-nf-exp string\n        Filter netflow Exporter. IP address of exporter device. eg: 192.168.1.1, 192.168.1.* (default \"*\")\n  -flt-nf-ver string\n        Filter netflow version. eg: 1, 5, 6, 7, 9, 10 (for IPFIX) (default \"*\")\n  -flt-proto string\n        Filter Protocol. eg: tcp, udp, icmp (default \"*\")\n  -flt-src-ip string\n        Filter Source IP. eg: 192.168.1.1, 192.168.1.* (default \"*\")\n  -flt-src-port string\n        Filter Source Port. eg: 80, 433, 100-250 (default \"*\")\n  -port string\n        Listen port - Default 7161\n```\n- **addr**: Listen address for Netflow Dumper tool. If you want to listen on available IP addresses you need to provide ```0.0.0.0```\n- **port**: Listen post for Netflow Dumper tool\n- **flt-nf-ver**: Filter packet based on netflow version.\n- **flt-nf-exp**: Filter packet based on netflow exporter. You might have different Netflow exporter and interested in one of them, So you can provide it here to filter the printer packets\n- **flt-proto**: Filter based on protocols. Like tcp, udp, gre.\n- **flt-src-ip** \u0026 **flt-dst-ip**: Filter based on source or destination IP Addresses.\n- **flt-src-port** \u0026 **flt-dst-port**: Filter based on source or destination port.\n\n\n# Grafana Dashboards\nI have made two simple \u0026 powerfull **Grafana** dashboards which you can download them from the further links:\n\n- [Netflow Exporter Overview](https://grafana.com/grafana/dashboards/11408)\n- [Netflow Summary Overview](https://grafana.com/grafana/dashboards/11409)\n\n![Netflow Exporter Dashboard](https://raw.githubusercontent.com/javadmohebbi/nfCollector/master/NetflowExporter%20Overview-Grafana.png)\n![Netflow Summary Dashboard](https://raw.githubusercontent.com/javadmohebbi/nfCollector/master/NetflowSummary%20Overview-Grafana.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjavadmohebbi%2Fnfcollector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjavadmohebbi%2Fnfcollector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjavadmohebbi%2Fnfcollector/lists"}