fprobe-ulog(8)

📦 version 1.2, in alpine 3.22, alpine 3.23, alpine 3.24, fedora 43, fedora 44

💖 fprobe-ulog — a NetFlow probe 💖

okay bestie, sit down, hydrate, and let me tell you about the fprobe-ulog manual page from the System Manager's Manual section. it's giving network-nerd royalty, it's giving ✨, and yes we're reading the whole thing together because i love you.

🌸 NAME 🌸

fprobe-ulog — a NetFlow probe

like... that's it. that's the whole name. short, iconic, no notes. 💅

🦋 SYNOPSIS 🦋

fprobe-ulog [options] remote:port[/[local][/type]] ...

see how it just says that? yeah. that's the whole vibe. options go first, then one or more collectors, and yes you can absolutely stack them, go off queen 👑

✨ DESCRIPTION ✨

fprobe-ulog is a libipulog-based tool. what does it do? it collects network traffic data and emits it as NetFlow flows towards the collector(s) you specify. that's the entire personality. it captures, it converts, it ships it out. no cap. 🫶

👑 OPTIONS 👑

bestie there are SO many options and i need you to read every single one. i'm not skipping a crumb. periodt.

  • -h — display short help. that's it. it's a little "hi, here's the tl;dr" moment 🎀
  • -U <mask> — ULOG group bitwise mask. [default=1]
  • -s <seconds> — how often it scans for expired flows. [default=5] — like a lil check-in sweep, so cute
  • -g <seconds> — fragmented flow lifetime. [default=30] — how long fragments get to hang around before they're sent off to the void
  • -d <seconds> — idle flow lifetime (that's the inactive timer). [default=60]
  • -e <seconds> — active flow lifetime (that's the active timer). [default=300]
  • -n <version> — NetFlow version to use. the valid ones are 1, 5, 7. [default=5]
  • -a <address> — use address as the source for NetFlow flow. main character energy, choosing your own origin story 💅
  • -X <rule[,...]> — a comma-separated list of rules for converting interface names into SNMP-indexes. each rule is an interface base name and an SNMP-index base, separated by a colon (for example ppp:200). the final SNMP-index is the sum of the corresponding SNMP-index base and the interface number. in that example, the SNMP-index of interface ppp11 is 211. and if an interface name doesn't match any of the conversion rules, then the SNMP-index just gets taken from the kernel. no drama, it figures it out ✨
  • -M — use the netfilter mark as the Type Of Service value. cute little repurposing moment 🔥
  • -b <flows> — memory bulk size. [default=200 or 10000] — heads up bestie, the maximum and default values depend on the compiling options (the --with-membulk parameter). so it's a ✨it depends✨ situation
  • -m <kilobytes> — memory limit for the flows cache. 0 means no limit. [default=0]
  • -q <flows> — pending queue length. [default=100] — okay so every captured packet goes into a special buffer first called the pending queue. its whole job is to separate the most time-critical packet capture thread from everything else. she's a bodyguard, she's a bouncer, she's doing the most 💖
  • -B <kilobytes> — kernel capture buffer size. 0 means don't change it. [default=0] — increasing the kernel capture buffer size is the most adequate way to prevent packet loss. but note: the maximum allowed size of this buffer in Linux is limited and generally relatively small, so you might need to change the max, like:
sysctl -w net/core/rmem_max=4194304
  • -r <priority> — real-time priority. 0 means disabled. [default=0] — if the parameter is greater than zero, fprobe-ulog will use real-time scheduling policy to prevent packet loss. note that the possible values for this option depend on the operating system. iykyk 🌈
  • -t <B:N> — emitting rate limit. 0:0 means no limit. [default=0:0] — it produces an N nanosecond delay after each B bytes sent. this one's handy with slow interfaces and slow collectors. but ⚠️ note that the suspension time may be longer than requested, because the argument value gets rounded up to an integer multiple of the sleep resolution (which depends on your operating system and hardware), or because the system is busy scheduling other activity. see the BUGS section below, bestie, i'm not gatekeeping
  • -c <directory> — directory to chroot to. 🧚
  • -u <user> — user to run as. 🧚
  • -v <level> — maximum displayed log level. the levels are: 0=EMERG, 1=ALERT, 2=CRIT, 3=ERR, 4=WARNING, 5=NOTICE, 6=INFO, 7=DEBUG. [default=6]
  • -l <[dst][:id]> — log destination (0=none, 1=syslog, 2=stdout, 3=both) plus a log/pidfile identifier. [default=1] — this option lets you pick your opportune log destination and your process identifier. the identifier helps distinguish the pidfile and logs of one fprobe-ulog process from another one's. and note: if the log destination contains stdout (so it equals 2 or 3), then fprobe-ulog will run in the foreground. ok so it's not like other girls, she stays in the room 💅
  • remote:port/local/type — the collector spec, and bestie this one has LAYERS:
    • remote and port define the address and port of the NetFlow collector, respectively.
    • local lets you bind a certain local IP address to that specified collector. if you omit this parameter, the value of the -a option (if any) gets used instead.
    • type determines the emitting behavior. it can be m for mirroring (which is the default) or r for collectors round-robin rotating.
    • and you may specify multiple collectors. stack 'em, queen 👑

🎀 EXAMPLES 🎀

here's the first one, look how cute:

fprobe-ulog -Xeth:100,ppp:200 localhost:2055

a reasonable configuration to run under heavy load:

fprobe-ulog -B4096 -r2 -q10000 -t10000:10000000 localhost:2055

and this one sends packets to the collector at 10.1.1.1:2055 while distributing them between the collectors at 10.1.1.2:2055 and at 10.1.1.3:2055 on a round-robin basis:

fprobe-ulog 10.1.1.1:2055 10.1.1.2:2055//r 10.1.1.3:2055//r

like, hello?? the range?? the rotation?? obsessed 😭

💀 BUGS 💀

okay bestie, this is the part where we sit up straight. two things to know. no skipping.

Slow interfaces and slow collectors.

there may be problems with slow interfaces and slow collectors. it shows up as emitted packet loss. on one hand, the silent non-blocking sendto() implementation can't guarantee that a packet was really sent to the collector — it may get dropped by the kernel due to outgoing buffer shortage (that's the slow interface's problem). and on the other hand, a packet may get dropped on the collector's machine for a similar reason — incoming buffer shortage (that's the slow collector's problem).

use the -t option as a workaround for this issue. 🫶

Locally originated packets and their timestamps.

locally originated packets do not contain valid timestamps. so fprobe-ulog fills the timestamp in by itself, at the act of receiving such a packet. unfortunately, between the netfilter code capturing the packet and fprobe-ulog receiving it, certain lags may occur — which means timestamps of locally originated packets are generally inexact. 🙈

it is possible to fix this problem entirely with a trivial kernel patch — see contrib/ipt_ULOG.patch.

🌈 SEE ALSO 🌈

and that's the whole page, bestie!! 💜 this was fprobe-ulog 1.1, dated 2005-01-29 — a genuine vintage icon from the System Manager's Manual era. she's been iconic since 2005 and she's still iconic now. go forth, probe those flows, and don't forget your -t workaround. mwah 🎀✨👑

📦 where this page comes from