Add ability to specify source IP of netflow emissions

[ekgermann]

Currently working with ipt-netflow on a linux based router with multiple interfaces (tunnels, etc).

It seems to randomly pick an interface to be the source interface for packets emitted.

Since many of the open-source collectors don't have the ability to specify an Engine ID, it would be helpful to have a config option to specify the source IP to be used when sending packets so it was static when interfaces were added or deleted to the linux box.

I've tried adding it myself, but my skills are a bit rusty.

EKG

[aabc]

Source should be picked not randomly, but depending on routing, such as primary IP of egress interface.

But, maybe this will be useful feature, I will think about it.

[aabc]

I implemented your feature request. Now you are obliged to test it. ;-)

[michaeljbailey]

@aabc -- I am using ipt-netflow 2.2 on an Ubiquiti router.

As of this version, it appears to be working flawlessly. I changed my sysctl parameters:

Old:
net.netflow.destination = 172.16.18.13:2055,172.16.18.135:2055

New:
net.netflow.destination = 172.16.18.13:2055@172.16.1.12,172.16.18.135:2055@172.16.1.12

When I perform a tcpdump on my destination box, I see the updated address working immediately after the parameter change:

10:47:13.605056 IP (tos 0x0, ttl 63, id 20105, offset 0, flags [DF], proto UDP (17), length 1442)
    172.16.4.66.46719 > 172.16.18.13.2055: [udp sum ok] UDP, length 1414
10:47:24.612787 IP (tos 0x0, ttl 63, id 20825, offset 0, flags [DF], proto UDP (17), length 1408)
    172.16.4.66.46719 > 172.16.18.13.2055: [udp sum ok] UDP, length 1380
10:47:25.444959 IP (tos 0x0, ttl 63, id 5507, offset 0, flags [DF], proto UDP (17), length 1099)
    172.16.1.12.54277 > 172.16.18.13.2055: [udp sum ok] UDP, length 1071
10:47:30.845108 IP (tos 0x0, ttl 63, id 5898, offset 0, flags [DF], proto UDP (17), length 1426)
    172.16.1.12.54277 > 172.16.18.13.2055: [udp sum ok] UDP, length 1398
10:47:42.545270 IP (tos 0x0, ttl 63, id 7323, offset 0, flags [DF], proto UDP (17), length 1445)
    172.16.1.12.54277 > 172.16.18.13.2055: [udp sum ok] UDP, length 1417
10:47:49.450658 IP (tos 0x0, ttl 63, id 8934, offset 0, flags [DF], proto UDP (17), length 1408)
    172.16.1.12.54277 > 172.16.18.13.2055: [udp sum ok] UDP, length 1380

Now obviously "one user" is not an extensive test case, but I am fairly certain your new configuration is fully functional :)

[aabc]

@michaeljbailey Thanks much for the testing!

[michaeljbailey]

@aabc I may have spoke a bit too soon. I tried testing with a source interface and it did not work for a subinterface:

net.netflow.destination 172.16.18.13:2055%switch0.410,172.16.18.135:2055%switch0.410

I no longer see any traffic netflow traffic generated, running either a local tcpdump or a remote tcpdump.

I am going to try testing with a plain interface descriptor (eth0, for example), to see if this might be an issue in the interface name parsing.

[aabc]

@michaeljbailey Please check if there is error messages in dmesg.

[michaeljbailey]

@aabc No messages in either dmesg or messages (where Ubiquiti typically dumps log messages).

I tested with a legitimate interface name and a dummy interface name. With a dummy interface name, I see the expected error message:

sysctl -w net.netflow.destination=172.16.18.13:2055%switch0.410,172.16.18.135:2055%sXZV$#T%

root@Router:~# tail /var/log/messages 
Apr 26 11:03:05 Router kernel: sysctl: The scan_unevictable_pages sysctl/node-interface has been disabled for lack of a legitimate use case.  If you have one, please send an email to linux-mm@kvack.org.
Apr 26 11:06:16 Router radvd[5711]: sendmsg: Operation not permitted
Apr 26 11:07:28  radvd[5711]: last message repeated 2 times
Apr 26 11:08:38 Router radvd[5711]: sendmsg: Operation not permitted
Apr 26 11:12:03 Router radvd[5711]: sendmsg: Operation not permitted
Apr 26 11:14:46 Router radvd[5711]: sendmsg: Operation not permitted
Apr 26 11:16:44 Router radvd[5711]: sendmsg: Operation not permitted
Apr 26 11:16:46 Router radvd[5711]: sendmsg: Operation not permitted
Apr 26 11:17:31 Router kernel: ipt_NETFLOW: error binding to device sXZV1T%, errno 0
Apr 26 11:18:32 Router kernel: last message repeated 8 times```

[aabc]

Thanks. That kernel version it is?

[aabc]

Btw, does switch0.410 have routing to the 172.16.18.13? You may try to check this with something like ip ro get 172.16.18.13 oif switch0.410.

[michaeljbailey]

Kernel version and route entry below:

root@Router:~# uname -a
Linux Router 3.10.107-UBNT #1 SMP Wed Feb 13 20:05:27 UTC 2019 mips GNU/Linux

Router~# ip ro get 172.16.18.13 oif switch0.410
172.16.18.13 dev switch0.410  src 172.16.4.70 
    cache