Netflow ingest with Bro?

Zeek
1

Hi all,

Is anyone using Bro's Netflow ingest capabilities? If so, what is the
output? Does Bro generate TCP and UDP events? Does it create a "conn"
log?

Some context from the Bro 1.4 release notes
(https://www.bro.org/sphinx/install/changes.html?highlight=netflow):

Bro now supports analyzing NetFlow v5 data, i.e., from Cisco routers
(Bernhard Ager). NetFlow can be useful for intrusion detection as it
allows analysis of traffic from many different points in the network.
Bro can now read NetFlow data from a UDP socket, as well as (mostly
for debugging purposes) from a file in a specialized format. You can
create these files with the programs given in aux/nftools.

Best,

Bob

2

Two netflow events:

    event netflow_v5_header(h: nf_v5_header);
    event netflow_v5_record(r: nf_v5_record);

I don't think we ever had a standard script doing something further
with these.

Note, the Netflow support has been removed in current git master along
with some of the restructuring, as it was neither much used nor tested
at all. But it's not inconceivable to bring it back before the next
release if there's demand for it.

Robin

3

Good to know. Thanks for the quick reply Robin!