rwflowpack

A role for configuring and managing the rwflowpack service. rwflowpack is a daemon that runs as part of the SiLK flow collection and packing tool-chain. The primary job of rwflowpack is to convert each incoming flow record to the SiLK Flow format, categorize each incoming flow record (e.g., as incoming or outgoing), set the sensor value for the record, and determine which hourly file will ultimately store the record. See rwflowpack documentation for more information.

Role Variables

Available variables are listed below, along with default values (see defaults/main.yml):

silk_packing_tools_loc: "/usr/local/sbin"

The folder location of the silk packing tools.

rwflowpack_myname: "rwflowpack"

The name of the rwflowpack process. It is possible to run multiple copies of rwflowpack on a single node by naming them differently.

rwflowpack_conf_template: "rwflowpack.conf.j2"
rwflowpack_conf_file_loc: "/usr/local/etc"
rwflowpack_conf_file_path: "{{ rwflowpack_conf_file_loc }}/{{ rwflowpack_myname }}.conf"
rwflowpack_init_template: "rwflowpack.j2"
rwflowpack_init_file_path: "/etc/init.d/{{ rwflowpack_myname }}"

Template sources to use and their destinations.

As part of collecting flow data, the rwflowpack and flowcap daemons need to know what type of data they are collecting and how to collect it (e.g., listen on 10000/udp for NetFlow v5; listen on 4740/tcp for IPFIX). In addition, the rwflowpack daemon needs information on how to categorize the flow: for example, to label the flows collected at a border router as incoming or outgoing. The Sensor Configuration file, sensor.conf, contains this information, and the following variables control it's location and contents. See the manual page for descriptions of the syntax of the file (see SYNTAX) and some example configurations (see EXAMPLES).

The silk.conf SiLK site configuration file is used to associate symbolic names with flow collection information stored in SiLK Flow records. In addition to the information contained in the NetFlow or IPFIX flow record (e.g., source and destination addresses and ports, IP protocol, time stamps, data volume), every SiLK Flow record has two additional pieces of information that is added when rwflowpack(8) converts the NetFlow or IPFIX record to the SiLK format: the sensor and the flowtype. See the manual page for more information about the usage and syntax of this file.

Dependencies

• cmusei.silk

Example Playbook

- hosts: servers
  vars:
    rwflowpack_create_directories: "yes"
    sensor_definitions: |
        sensor 0 S0    "Description for sensor S0"
    class_block_definitions: |
        class all
            sensors S0
        end class
    sensor_conf_file_contents: |
        probe S0 ipfix
            poll-directory /tmp
        end probe
        
        sensor S0
            ipfix-probes S0
            internal-ipblock 128.2.0.0/16
            external-ipblock remainder
        end sensor
  roles:
    - role: cmusei.rwflowpack
      tags: [ 'rwflowpack' ]

License

Copyright 2020 Carnegie Mellon University. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. Released under a MIT (SEI)-style license, please see license.txt or contact permission@sei.cmu.edu for full terms. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. CERT® is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. This Software includes and/or makes use of the following Third-Party Software subject to its own license:

1. ansible (https://github.com/ansible/ansible/tree/devel/licenses) Copyright 2019 Red Hat, Inc.
2. molecule (https://github.com/ansible-community/molecule/blob/master/LICENSE) Copyright 2018 Red Hat, Inc.
3. testinfra (https://github.com/philpep/testinfra/blob/master/LICENSE) Copyright 2020 Philippe Pepiot.

DM20-0532

Author Information

This role was created in 2020 by Matt Heckathorn.