Set up NetFlow export by protocols, directions and billing

Changing the settings or disabling the option is done by editing The configuration file is '/etc/dpi/fastdpi.conf'.

NetFlow options are cold and you need to restart the service.

NetFlow on protocols

IP address and NetFlow collector port number with statistics by protocols :

netflow_collector=192.168.0.1:9997

NetFlow in directions

IP address and NetFlow collector port number with statistics by direction:

netflow_as_collector=192.168.0.1:9998

Directions for which statistics and aggregation are collected:

netflow_as_direction=1

1 - only for external autonomous systems (suitable for home operators, since there are no other autonomous systems on one side apart from the operator himself)

2 - only for internal autonomous systems

3 = 1 + 2 - suitable for transit operators, but since AS is an independent aggregation, the exported statistics data will get 2 times - for each of the AS, participants in the transfer

NetFlow for billing

IP address and NetFlow collector port number with statistics for billing, you need to allocate a separate collector so that the data is not mixed with other statistics:

netflow_bill_collector=192. 168.0.1:9995

Billing statistics are transmitted only by subscribers who are connected to service 9.\ IPFIX does not transmit information about the host IP:port with which the subscriber exchanges information.

Determination of the format of the transmitted information:

netflow_bill_collector_type=2

0 - netflow_v5 (default)

1 - ipfix udp

2 - ipfix tcp

By default, the full amount of information transmitted, including packet headers L1-L7, is considered to be considered payload and only L3-L7 headers must specify the parameter:

netflow_bill_method=1

In netflow, the TOS field of billing statistics transmits the traffic class assigned by DPI, which can be used to create flexible pricing plans.

Sending template to IPFIX

The TCP.
Template transport protocol is sent once after the TCP session has been established.

The UDP.
Template transport protocol is sent by default every 20 seconds. Adjusted by ipfix_udp_template_timer.

Example of configuration

An example of configuration is described in the section QoE Stor: DPI Configuration.