{"id":21007919,"url":"https://github.com/lflxp/lflxp-sflowtool","last_synced_at":"2026-04-28T14:02:08.572Z","repository":{"id":57519454,"uuid":"249391363","full_name":"lflxp/lflxp-sflowtool","owner":"lflxp","description":"Real time monitoring tool for network traffic","archived":false,"fork":false,"pushed_at":"2020-03-23T10:31:57.000Z","size":34,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-01-20T10:48:23.278Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lflxp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-03-23T09:47:36.000Z","updated_at":"2021-10-21T07:20:33.000Z","dependencies_parsed_at":"2022-08-29T23:41:18.328Z","dependency_job_id":null,"html_url":"https://github.com/lflxp/lflxp-sflowtool","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lflxp%2Flflxp-sflowtool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lflxp%2Flflxp-sflowtool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lflxp%2Flflxp-sflowtool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lflxp%2Flflxp-sflowtool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lflxp","download_url":"https://codeload.github.com/lflxp/lflxp-sflowtool/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243428436,"owners_count":20289317,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-19T09:10:51.212Z","updated_at":"2025-12-28T14:57:44.894Z","avatar_url":"https://github.com/lflxp.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# lflxp-sflowtool\nReal time monitoring tool for network traffic\n\n# Requiremenets\n\n`Centos`\n\n\u003e sudo yum install libpcap-devel -y\n\n`Debian`\n\n\u003e sudo apt-get install libpcap-dev -y\n\n# Install\n\n```\ngit clone https://github.com/lflxp/lflxp-sflowtool\ncd lflxp-sflowtool\nmake install\nlflxp-sflowtool -h\n```\n\n`For Coder Demo`\n\n\u003e cmd/main.go\n\n```go\npackage main\n\nimport (\n\t\"flag\"\n\t//\t\"github.com/google/gopacket/afpacket\"\n\t\"net\"\n\t\"time\"\n\n\t\"github.com/lflxp/lflxp-sflowtool/pkg\"\n\tlog \"github.com/sirupsen/logrus\"\n)\n\nvar Con pkg.Collected = pkg.Collected{\n\tDeviceName:  \"en0\",\n\tSnapShotLen: 65535,\n\tPromiscuous: true,\n\tTimeout:     30 * time.Second,\n}\n\nfunc main() {\n\twait := make(chan int)\n\titem := flag.String(\"t\", \"all\", \"类型:all(sflowSample|Counter),counter(SflowCounter),sample(SflowSample),netflow\")\n\tprotocol := flag.String(\"s\", \"udp\", \"协议\")\n\tport := flag.String(\"p\", \"6343\", \"端口\")\n\teth := flag.String(\"ee\", \"en0\", \"网卡名\")\n\tudp := flag.Bool(\"udp\", false, \"是否开启udp数据传输,默认不开启\")\n\tudport := flag.String(\"host\", \"127.0.0.1:6666\", \"udp SFlowSample And Netflow 传输主机:端口\")\n\tcounterport := flag.String(\"chost\", \"127.0.0.1:7777\", \"udp CounterSample 传输主机:端口\")\n\tesurl := flag.String(\"es\", \"http://127.0.0.1:9200\", \"elasticsearch 5.6 接口地址\")\n\tises := flag.Bool(\"ises\", false, \"是否开启output到elasticsearch\")\n\tdebug := flag.Bool(\"debug\", false, \"是否开启debug model\")\n\tindex := flag.String(\"index\", \"sflow\", \"es index name, example: sflow-2019-09-06\")\n\tflag.Parse()\n\n\tCon.DeviceName = *eth\n\tCon.Host = *udport\n\tCon.Udpbool = *udp\n\tCon.CounterHost = *counterport\n\tCon.EsPath = *esurl\n\tCon.IsEs = *ises\n\tCon.Index = *index\n\n\t// 初始化es index\n\tif Con.IsEs {\n\t\tlog.Info(\"开启es通道\")\n\t\tpkg.InitEs(Con.EsPath, Con.Index)\n\t}\n\n\t// 是否开启udp数据转发\n\tif *udp {\n\t\tConn, err := net.Dial(\"udp\", *udport)\n\t\tdefer Conn.Close()\n\t\tif err != nil {\n\t\t\tpanic(err)\n\t\t}\n\t}\n\n\t// 设置日志级别\n\tif *debug {\n\t\tlog.SetLevel(log.DebugLevel)\n\t\tlog.Info(\"日志模式 DEBUG\")\n\t} else {\n\t\tlog.SetLevel(log.InfoLevel)\n\t\tlog.Info(\"日志模式 INFO\")\n\t}\n\n\t// 启动命令\n\tif *item == \"all\" {\n\t\tSflowAll(*protocol, *port)\n\t} else if *item == \"counter\" {\n\t\tSflowCounter(*protocol, *port)\n\t} else if *item == \"sample\" {\n\t\tSflowSample(*protocol, *port)\n\t} else if *item == \"netflow\" {\n\t\tNetflowV5(*protocol, *port)\n\t}\n\n\t\u003c-wait\n}\n\nfunc SflowCounter(protocol, port string) {\n\tCon.ListenSflowCounter(protocol, port)\n}\n\nfunc SflowSample(protocol, port string) {\n\tCon.ListenSFlowSample(protocol, port)\n}\n\n//include SFlowSample and SflowCounter\nfunc SflowAll(protocol, port string) {\n\tCon.ListenSflowAll(protocol, port)\n}\n\nfunc NetflowV5(protocol, port string) {\n\tCon.ListenNetFlowV5(protocol, port)\n}\n```\n\n# Usage\n\n`Format`\n\n```bash\n➜  lflxp-sflowtool git:(master) ✗ lflxp-sflowtool -h\nUsage of lflxp-sflowtool:\n  -chost string\n        udp CounterSample 传输主机:端口 (default \"127.0.0.1:7777\")\n  -debug\n        是否开启debug model\n  -ee string\n        网卡名 (default \"en0\")\n  -es string\n        elasticsearch 5.6 接口地址 (default \"http://127.0.0.1:9200\")\n  -host string\n        udp SFlowSample And Netflow 传输主机:端口 (default \"127.0.0.1:6666\")\n  -index string\n        es index name, example: sflow-2019-09-06 (default \"sflow\")\n  -ises\n        是否开启output到elasticsearch\n  -p string\n        端口 (default \"6343\")\n  -s string\n        协议 (default \"udp\")\n  -strict.perms\n        Strict permission checking on config files (default true)\n  -t string\n        类型:all(sflowSample|Counter),counter(SflowCounter),sample(SflowSample),netflow (default \"all\")\n  -udp\n        是否开启udp数据传输,默认不开启\n```\n\n* Read Only Command\n    \u003e sudo ./lflxp-sflowtool -p 9999 -t all --debug --ee enp1s0\n* Elasticsearch on\n    \u003e sudo ./lflxp-sflowtool -p 9999 -t all -debug -ee enp1s0 -es http://127.0.0.1:9200 -ises\n\n# OutPut\n\nthose functions output json used by logstash to collected\n\n# Example\n\n## SFlowSample\n\nSFlowSample just only detectd 5 layers \n\n* SFlowRawPacketFlowRecord \n* SFlowExtendedSwitchFlowRecord \n* SFlowExtendedRouterFlowRecord \n* SFlowExtendedGatewayFlowRecord \n* SFlowExtendedUserFlow\n\n```\n{\n   \"Data\": {\n      \"Datagram\": {\n         \"SrcMac\": \"70:99:99:04:99:99\",\n         \"DstMac\": \"70:4d:99:99:99:99\",\n         \"SrcIP\": \"99.99.99.205\",\n         \"DstIP\": \"99.99.99.8\",\n         \"SrcPort\": \"9999(distinct)\",\n         \"DstPort\": \"9999(distinct)\"\n      },\n      \"DatagramVersion\": 5,\n      \"AgentAddress\": \"99.99.99.53\",\n      \"SubAgentID\": 2,\n      \"SequenceNumber\": 1275756,\n      \"AgentUptime\": 3164307152,\n      \"SampleCount\": 2\n   },\n   \"EnterpriseID\": \"Standard SFlow\",\n   \"Format\": \"Expanded Flow Sample\",\n   \"SampleLength\": 244,\n   \"SequenceNumber\": 1251869,\n   \"SourceIDClass\": \"Single Interface\",\n   \"SourceIDIndex\": \"71\",\n   \"SamplingRate\": 20000,\n   \"SamplePool\": 3990725044,\n   \"Dropped\": 0,\n   \"InputInterfaceFormat\": 0,\n   \"InputInterface\": 71,\n   \"OutputInterfaceFormat\": 0,\n   \"OutputInterface\": 114,\n   \"RecordCount\": 3,\n   \"SFlowRawPacketFlowRecord\": {\n      \"SFlowBaseFlowRecord\": {\n         \"EnterpriseID\": \"Standard SFlow\",\n         \"Format\": \"Raw Packet Flow Record\",\n         \"FlowDataLength\": 144\n      },\n      \"HeaderProtocol\": \"ETHERNET-ISO88023\",\n      \"FrameLength\": 1518,\n      \"PayloadRemoved\": 4,\n      \"HeaderLength\": 128,\n      \"Header\": {\n         \"FlowRecords\": 144,\n         \"Packets\": 1,\n         \"Bytes\": 1518,\n         \"SrcMac\": \"99:8c:40:99:99:99\",\n         \"DstMac\": \"99:8c:40:99:99:ab\",\n         \"SrcIP\": \"99.99.99.26\",\n         \"DstIP\": \"99.99.99.57\",\n         \"Ipv4_version\": 4,\n         \"Ipv4_ihl\": 5,\n         \"Ipv4_tos\": 0,\n         \"Ipv4_ttl\": 62,\n         \"Ipv4_protocol\": \"TCP\",\n         \"SrcPort\": \"49165\",\n         \"DstPort\": \"33851\"\n      }\n   },\n   \"SFlowExtendedSwitchFlowRecord\": {\n      \"SFlowBaseFlowRecord\": {\n         \"EnterpriseID\": \"Standard SFlow\",\n         \"Format\": \"Extended Switch Flow Record\",\n         \"FlowDataLength\": 16\n      },\n      \"IncomingVLAN\": 0,\n      \"IncomingVLANPriority\": 0,\n      \"OutgoingVLAN\": 0,\n      \"OutgoingVLANPriority\": 0\n   },\n   \"SFlowExtendedRouterFlowRecord\": {\n      \"SFlowBaseFlowRecord\": {\n         \"EnterpriseID\": \"Standard SFlow\",\n         \"Format\": \"Extended Router Flow Record\",\n         \"FlowDataLength\": 16\n      },\n      \"NextHop\": \"99.99.99.206\",\n      \"NextHopSourceMask\": 22,\n      \"NextHopDestinationMask\": 21\n   },\n   \"SFlowExtendedGatewayFlowRecord\": {\n      \"SFlowBaseFlowRecord\": {\n         \"EnterpriseID\": \"\",\n         \"Format\": \"\",\n         \"FlowDataLength\": 0\n      },\n      \"NextHop\": \"\",\n      \"AS\": 0,\n      \"SourceAS\": 0,\n      \"PeerAS\": 0,\n      \"ASPathCount\": 0,\n      \"ASPath\": null,\n      \"Communities\": null,\n      \"LocalPref\": 0\n   },\n   \"SFlowExtendedUserFlow\": {\n      \"SFlowBaseFlowRecord\": {\n         \"EnterpriseID\": \"\",\n         \"Format\": \"\",\n         \"FlowDataLength\": 0\n      },\n      \"SourceCharSet\": \"\",\n      \"SourceUserID\": \"\",\n      \"DestinationCharSet\": \"\",\n      \"DestinationUserID\": \"\"\n   }\n}\n```\n\n## SFlowCounter\n\nSFlowCounterSample contain 3 layers \n\n* SFlowGenericInterfaceCounters \n* SFlowEthernetCounters \n* SFlowProcessorCounters\n\n```\n{\n   \"Data\": {\n      \"Datagram\": {\n         \"SrcMac\": \"99:99:ef:04:99:99\",\n         \"DstMac\": \"99:99:7b:b8:99:99\",\n         \"SrcIP\": \"99.99.99.205\",\n         \"DstIP\": \"99.99.99.8\",\n         \"SrcPort\": \"9999(distinct)\",\n         \"DstPort\": \"9999(distinct)\"\n      },\n      \"DatagramVersion\": 5,\n      \"AgentAddress\": \"99.99.99.53\",\n      \"SubAgentID\": 2,\n      \"SequenceNumber\": 1280989,\n      \"AgentUptime\": 3164899152,\n      \"SampleCount\": 3\n   },\n   \"EnterpriseID\": \"Standard SFlow\",\n   \"Format\": \"Expanded Counter Sample\",\n   \"SampleLength\": 172,\n   \"SequenceNumber\": 2865,\n   \"SourceIDClass\": \"Single Interface\",\n   \"SourceIDIndex\": \"72\",\n   \"RecordCount\": 2,\n   \"SFlowGenericInterfaceCounters\": {\n      \"SFlowBaseCounterRecord\": {\n         \"EnterpriseID\": \"Standard SFlow\",\n         \"Format\": \"Generic Interface Counters\",\n         \"FlowDataLength\": 88\n      },\n      \"IfIndex\": 72,\n      \"IfType\": 6,\n      \"IfSpeed\": 10000000000,\n      \"IfDirection\": 1,\n      \"IfStatus\": 3,\n      \"IfInOctets\": 104160000662999,\n      \"IfInUcastPkts\": 92171299,\n      \"IfInMulticastPkts\": 82243,\n      \"IfInBroadcastPkts\": 1,\n      \"IfInDiscards\": 0,\n      \"IfInErrors\": 0,\n      \"IfInUnknownProtos\": 0,\n      \"IfOutOctets\": 992414418961899,\n      \"IfOutUcastPkts\": 9939958927,\n      \"IfOutMulticastPkts\": 82489,\n      \"IfOutBroadcastPkts\": 0,\n      \"IfOutDiscards\": 28017,\n      \"IfOutErrors\": 0,\n      \"IfPromiscuousMode\": 2\n   },\n   \"SFlowEthernetCounters\": {\n      \"SFlowBaseCounterRecord\": {\n         \"EnterpriseID\": \"Standard SFlow\",\n         \"Format\": \"Ethernet Interface Counters\",\n         \"FlowDataLength\": 99\n      },\n      \"AlignmentErrors\": 0,\n      \"FCSErrors\": 0,\n      \"SingleCollisionFrames\": 0,\n      \"MultipleCollisionFrames\": 0,\n      \"SQETestErrors\": 0,\n      \"DeferredTransmissions\": 0,\n      \"LateCollisions\": 0,\n      \"ExcessiveCollisions\": 0,\n      \"InternalMacTransmitErrors\": 0,\n      \"CarrierSenseErrors\": 0,\n      \"FrameTooLongs\": 0,\n      \"InternalMacReceiveErrors\": 0,\n      \"SymbolErrors\": 0\n   },\n   \"SFlowProcessorCounters\": {\n      \"SFlowBaseCounterRecord\": {\n         \"EnterpriseID\": \"\",\n         \"Format\": \"\",\n         \"FlowDataLength\": 0\n      },\n      \"FiveSecCpu\": 0,\n      \"OneMinCpu\": 0,\n      \"FiveMinCpu\": 0,\n      \"TotalMemory\": 0,\n      \"FreeMemory\": 0\n   }\n}\n```\n\n# NetFlowV5\n\n```\n{\n   \"version\": 5,\n   \"flow_records\": 30,\n   \"uptime\": 537043304,\n   \"unix_sec\": 1509090197,\n   \"unix_nsec\": 0,\n   \"flow_seq_num\": 245226516,\n   \"engine_type\": 0,\n   \"engine_id\": 1,\n   \"sampling_interval\": 0,\n   \"input_snmp\": 50,\n   \"output_snmp\": 0,\n   \"in_pkts\": 1,\n   \"in_bytes\": 476,\n   \"first_switched\": 537025674,\n   \"last_switched\": 537025674,\n   \"l4_src_port\": 53,\n   \"l4_dst_port\": 60657,\n   \"tcp_flags\": 0,\n   \"protocol\": 17,\n   \"src_tos\": 0,\n   \"src_as\": 0,\n   \"dst_as\": 0,\n   \"src_mask\": 0,\n   \"dst_mask\": 32,\n   \"host\": \"99.99.99.6\",\n   \"sampling_algorithm\": 0,\n   \"ipv4_src_addr\": \"99.99.99.19\",\n   \"ipv4_dst_addr\": \"99.99.99.25\",\n   \"ipv4_next_hop\": \"0.0.0.0\"\n}\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flflxp%2Flflxp-sflowtool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flflxp%2Flflxp-sflowtool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flflxp%2Flflxp-sflowtool/lists"}