OpenWRT (softflowd)

Softflowd is a flow-based network traffic analyzer that can be used to export flow data using NetFlow protocol. To configure softflowd on an OpenWRT router, follow these steps:

Install softflowd

First, you need to install the softflowd package on your OpenWRT router. Connect to the router via SSH or use the built-in terminal in the LuCI web interface. Once connected, run the following command to update the package list and install softflowd:

opkg update
opkg install softflowd

Configure softflowd

To configure softflowd, you need to create a configuration file. The default configuration file is located at /etc/config/softflowd. You can create and edit this file using the vi editor or another text editor of your choice:

vi /etc/config/softflowd

Add the following lines to the configuration file, replacing the example values with your specific configuration:

config softflowd
    option enabled        '1'
    option interface      'br-lan'
    option timeout        'tcp.rst=10'
    option timeout        'tcp.fin=10'
    option timeout        'expint=10'
    option timeout        'icmp=20'
    option timeout        'tcp=60'
    option timeout        'maxlife=60'
    option timeout        'general=60'
    option timeout        'udp=60'
    option max_flows      '8192'
    option host_port      '192.0.2.11:2055'
    option pid_file       '/var/run/softflowd.pid'
    option control_socket '/var/run/softflowd.ctl'
    option export_version '9'
    option hoplimit       '255'
    option tracking_level 'ether'
    option track_ipv6     '1'
    option sampling_rate  '1'

Replace br-lan with the interface you want to monitor, and 192.0.2.11:2055 with the IP address and port number of your ElastiFlow NetObserv Flow. Adjust other options as needed.

Start softflowd

To start softflowd, run the following command:

/etc/init.d/softflowd start

Enable softflowd on startup

To ensure that softflowd starts automatically when the router boots, run the following command:

/etc/init.d/softflowd enable

Verify softflowd is running

To verify that softflowd is running and exporting flow data, you can check the status with the following command:

/etc/init.d/softflowd status

Once you have completed these steps, softflowd will start exporting flow data to NetObserv Flow. Make sure NetObserv Flow is set up to receive and process the exported data for analysis and monitoring purposes.