HPR2944: ONICS Basics Part 4: Network Flows and Connections

Terminology

• connection - a bi-directional communication channel between two programs over a network
• client - the initiator of a connection
• server - the receiver of the connection
• port - a common term for the address of a program or service on a given machine
• 5-tuple - the combination of protocol, client machine network address, client port, server machine network address, server port that uniquely identifies a connection
• flow - a grouping of packets to be treated in a common way
• microflow - a flow with a fine level of granularity such as the packets from one direction of traffic in a connection

The topflow.sh Script

#!/bin/sh

# Start a capture in the background that drops the packets
# and just reports the flow events
pktin $1 | nftrk -d -f /tmp/flows.txt &
PID=$!

# On CTRL-C clean kill the capture and clean up
trap "kill $PID ; rm -f /tmp/flows.txt /tmp/topflows.txt /tmp/namecache.txt ; exit 0" INT TERM

# Once per second do
#   look at the last 100 flows
#   sort them by 5-tuple
#   remove duplicates
#   convert ports, protocols and addresses to names
#   sort by data usage per flow in reverse order (highest first)
#   a little more pretty printing
#   only take the top 20 lines
#   clear the screen and print the result
while [ 1 ] ; do
    tail -100 /tmp/flows.txt |
            sort -s -t '|' -k 3,3 |
            awk -f uniqflows.awk  |
            awk -f prflow.awk  |
            sort -s -t ',' -k 3 -r |
            awk -f columns.awk |
            head -20 > /tmp/topflows.txt
    clear
    cat /tmp/topflows.txt
    sleep 1
done

You can find the complete code at: https://gitlab.com/onics/onics-examples

Comments

More Information...