Wanguard 6.2 User Guide
Configuration » Components » Flow Sensor
•
“Null” – Traffic to Null interfaces is discarded by the router and should be ignored.
○
Top Generator
– Allows generating traffic tops:
•
“Basic” – Enables tops for Internal IPs, IP protocols, versions and TCP/UDP ports. It adds a very
small performance penalty.
•
“Extended” (recommended) – Enables all tops from “Basic” as well as tops and graphs for
autonomous systems and countries, but increases the CPU usage by a few percentage points.
When the router does not export AS information (e.g. non-BGP router) Flow Sensor uses an
internal GeoIP database to get ASNs. Live stats for autonomous systems and countries are not
very accurate.
•
“Full” – Enables all tops from “Extended” as well as tops for external IPs (IPs not included in the
IP Zone), but increases the RAM usage several times over, especially during spoofed attacks.
Live stats for autonomous systems and countries are very accurate. Set the value to “Extended”,
unless you know what you are doing.
○
Link Speed In & Link Speed Out
– Enter the speed (bandwidth, capacity) of the interface. The values
are used for percentage-based reports and percentage-based bits/s thresholds.
●
Comments
– Comments about the Flow Sensor can be saved here. These observations are not visible
elsewhere.
To start the Flow Sensor, click the gray square button next to its name in Configuration » Components.
Ensure that the Flow Sensor starts correctly by watching the event log (details on page 69).
If the Flow Sensor starts without errors, but you can't see any data collected by it in Reports » Components »
Overview after more than 5 minutes, follow the troubleshooting guide below.
Flow Sensor Troubleshooting
✔
Look for warnings or errors produced by the Flow Sensor in the event log (details on page 69).
✔
Check if you have correctly configured the Flow Sensor. Each configuration field is described in depth in
the previous section.
✔
The event log error “
License key not compatible with the existing server”
can be fixed by sending the
string from Configuration » Servers » [Flow Sensor server] » Hardware Key to sales@andrisoft.com.
✔
Ensure that the server is receiving flow packets on the configured
Listener IP:Port
:
tcpdump -i <interface_eth0_or_p1p1_etc> -n -c 100 host <flow_exporter_ip> and udp
and port <destination_port>
✔
Make sure that the local firewall permits the Flow Sensor to receive flow packets:
iptables -L -n -v && iptables -t raw -L -n -v
✔
Ensure that the clocks of both devices are synchronized with NTP. When the devices do not reside in the
same time zone, adjust the
Time Settings
parameter from the Flow Sensor configuration accordingly.
✔
The Flow Sensor may crash during spoofed attacks for not having enough RAM when a monitored
interface has the
Top Generator
parameter set to “Full”. It is highly recommended to set the
Top
Generator
parameter to “Extended” not to “Full” on systems with low amounts of RAM.
- 44 -
Summary of Contents for wanguard 6.2
Page 1: ......
