我使用 VMWare 在我的 Windows Server 上创建了两个 VM。
两台VM都是CentOS-7.2。
我的 FastNetMon 版本如下：
/opt/fastnetmon/fastnetmon --version
Version: 1.1.3 master git-94f4947e87753b8be193ca54d17dac24cac599fb
每个都有两个网络接口，一个是NAT，另一个是hostly。
VM1 的地址为：45.117.42.135(NAT)、10.1.1.135(hostly) VM2 的地址为：45.117.42.136(NAT)、10.1.1.136(hostly)
VM1安装FastNetMon和iperf，VM2安装iperf：
FastNetMon安装链接：https://fastnetmon.com/install/
Iperf 只需使用yum install -y iperf就可以访问它。
在 VM1 中，fastnetmon以守护进程形式运行服务器，并且fastnetmon_client：
# /opt/fastnetmon/fastnetmon --daemonize
并运行 iperf：
# iperf -s -u
在VM2中，我使用iperf向VM1发送UDP包：
# iperf -u -c 10.1.1.135 -b 200M -P 5
------------------------------------------------------------
Client connecting to 10.1.1.135, UDP port 5001
Sending 1470 byte datagrams, IPG target: 56.08 us (kalman adjust)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 7] local 10.1.1.136 port 33686 connected with 10.1.1.135 port 5001
[ 3] local 10.1.1.136 port 38157 connected with 10.1.1.135 port 5001
[ 5] local 10.1.1.136 port 47362 connected with 10.1.1.135 port 5001
[ 6] local 10.1.1.136 port 34624 connected with 10.1.1.135 port 5001
[ 4] local 10.1.1.136 port 55399 connected with 10.1.1.135 port 5001
[ ID] Interval Transfer Bandwidth
[ 7] 0.0-10.0 sec 250 MBytes 210 Mbits/sec
[ 7] Sent 178328 datagrams
[ 3] 0.0-10.0 sec 7.18 KBytes 5.88 Kbits/sec
[ 3] Sent 5 datagrams
[ 5] 0.0-10.0 sec 1.44 KBytes 1.18 Kbits/sec
[ 5] Sent 1 datagrams
[ 6] 0.0-10.0 sec 1.44 KBytes 1.18 Kbits/sec
[ 6] Sent 1 datagrams
[ 4] 0.0-10.0 sec 250 MBytes 210 Mbits/sec
[ 4] Sent 178317 datagrams
[SUM] 0.0-10.0 sec 500 MBytes 419 Mbits/sec
[SUM] Sent 356652 datagrams
[ 6] Server Report:
[ 6] 0.0-10.0 sec 249 MBytes 209 Mbits/sec 0.025 ms 556/178324 (0.31%)
[ 6] 0.00-10.00 sec 64 datagrams received out-of-order
[ 7] Server Report:
[ 7] 0.0-10.0 sec 249 MBytes 209 Mbits/sec 0.000 ms 736/178328 (0%)
[ 7] 0.00-10.00 sec 1 datagrams received out-of-order
[ 3] Server Report:
[ 3] 0.0-10.0 sec 247 MBytes 207 Mbits/sec 0.017 ms 2045/178303 (1.1%)
[ 3] 0.00-10.01 sec 56 datagrams received out-of-order
[ 4] Server Report:
[ 4] 0.0-10.0 sec 245 MBytes 206 Mbits/sec 0.030 ms 3570/178317 (2%)
[ 5] Server Report:
[ 5] 0.0-10.0 sec 249 MBytes 208 Mbits/sec 0.028 ms 1053/178326 (0.59%)
在 VM1 中，我得到了下面的打印结果：
[ 8] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 38695
[ 3] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 60248
[ 4] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 58492
[ 5] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 47149
[ 6] local 10.1.1.135 port 5001 connected with 10.1.1.136 port 53030
[ 3] 0.0-10.0 sec 247 MBytes 207 Mbits/sec 0.013 ms 1932/178319 (1.1%)
[ 3] 0.00-10.00 sec 132 datagrams received out-of-order
[ 5] 0.0-10.0 sec 249 MBytes 209 Mbits/sec 0.007 ms 956/178316 (0.54%)
[ 6] 0.0-10.0 sec 249 MBytes 209 Mbits/sec 0.015 ms 922/178318 (0.52%)
[ 8] 0.0-10.0 sec 249 MBytes 208 Mbits/sec 0.026 ms 1040/178320 (0.58%)
[ 8] 0.00-10.00 sec 2 datagrams received out-of-order
[ 4] 0.0-10.0 sec 248 MBytes 208 Mbits/sec 0.026 ms 1326/178326 (0.74%)
[ 4] 0.00-10.00 sec 41 datagrams received out-of-order
[SUM] 0.0-10.0 sec 1.21 GBytes 1.04 Gbits/sec 0.026 ms 6176/891599 (0.69%)
[SUM] 0.00-10.00 sec 175 datagrams received out-of-order
但在VM1的fastnetmon中，传入流量，传出流量始终是0：
（抱歉，是快照，不是代码，因为我无法复制它）
为什么他们0没有影响？
它也不监听 TCP 数据报。
编辑
以下是我的fastnetmon.conf：
# cat /etc/fastnetmon.conf | grep -v "#" |grep -v "^;"|grep -v "^$"
logging:local_syslog_logging = off
logging:remote_syslog_logging = off
logging:remote_syslog_server = 10.10.10.10
logging:remote_syslog_port = 514
enable_ban = on
process_incoming_traffic = on
process_outgoing_traffic = on
ban_details_records_count = 500
ban_time = 1900
unban_only_if_attack_finished = on
enable_subnet_counters = off
networks_list_path = /etc/networks_list
white_list_path = /etc/networks_whitelist
check_period = 1
enable_connection_tracking = off
ban_for_pps = on
ban_for_bandwidth = on
ban_for_flows = off
threshold_pps = 200
threshold_mbps = 10
threshold_flows = 350
threshold_tcp_mbps = 100000
threshold_udp_mbps = 100000
threshold_icmp_mbps = 100000
threshold_tcp_pps = 100000
threshold_udp_pps = 100000
threshold_icmp_pps = 100000
ban_for_tcp_bandwidth = off
ban_for_udp_bandwidth = off
ban_for_icmp_bandwidth = off
ban_for_tcp_pps = off
ban_for_udp_pps = off
ban_for_icmp_pps = off
mirror = off
pfring_sampling_ratio = 1
mirror_netmap = off
mirror_snabbswitch = off
mirror_afpacket = off
interfaces = eno16777,eno33554
netmap_sampling_ratio = 1
netmap_read_packet_length_from_ip_header = off
pcap = off
netflow = on
sflow = on
enable_pf_ring_zc_mode = off
interfaces = eno16777,eno33554
average_calculation_time = 5
average_calculation_time_for_subnets = 20
netflow_port = 2055
netflow_host = 0.0.0.0
netflow_sampling_ratio = 1
netflow_divide_counters_on_interval_length = off
sflow_port = 6343
sflow_host = 0.0.0.0
notify_script_path = /usr/local/bin/notify_about_attack.sh
notify_script_pass_details = on
collect_attack_pcap_dumps = off
process_pcap_attack_dumps_with_dpi = off
redis_enabled = off
redis_port = 6379
redis_host = 127.0.0.1
redis_prefix = mydc1
mongodb_enabled = off
mongodb_host = localhost
mongodb_port = 27017
mongodb_database_name = fastnetmon
pfring_hardware_filters_enabled = off
exabgp = off
exabgp_command_pipe = /var/run/exabgp.cmd
exabgp_community = 65001:666
exabgp_next_hop = 10.0.3.114
exabgp_announce_host = on
exabgp_announce_whole_subnet = off
exabgp_flow_spec_announces = off
gobgp = off
gobgp_next_hop = 0.0.0.0
gobgp_announce_host = on
gobgp_announce_whole_subnet = off
graphite = off
graphite_host = 127.0.0.1
graphite_port = 2003
graphite_prefix = fastnetmon
monitor_local_ip_addresses = on
hostgroup = my_hosts:10.10.10.221/32,10.10.10.222/32
my_hosts_enable_ban = off
my_hosts_ban_for_pps = off
my_hosts_ban_for_bandwidth = off
my_hosts_ban_for_flows = off
my_hosts_threshold_pps = 20000
my_hosts_threshold_mbps = 1000
my_hosts_threshold_flows = 3500
pid_path = /var/run/fastnetmon.pid
cli_stats_file_path = /tmp/fastnetmon.dat
enable_api = off
sort_parameter = packets
max_ips_in_list = 7
我/etc/networks_list的如下：
10.1.1.0/24
45.117.42.0/24
编辑-2
我尝试打开 PF_RING /etc/fastnetmon.conf：
mirror = on
并重新启动 fastnetmon，它无法启动。在/var/log/fastnetmon.log：
[错误] PF_RING 初始化失败，退出程序
我lsmod检查了一下，什么也没发现：
# lsmod |grep pf_ring
所以PF_RING没有安装成功。
我也打开了pcap捕获流量，仍然无法成功运行fastnetmon。
編輯-3
最后，我安装PF_RING成功，并打开mirror=on，然后我可以看到内部流量：
我现在的问题是
但为什么我的传入流量和传出流量仍然存在0？我的意思是如果我使用 DDoS 攻击它，它仍然存在0，内部流量将快速增加。
我还安装了 influxdb：
# influx
Visit https://enterprise.influxdata.com to register for updates, InfluxDB server management, and monitoring.
Connected to http://localhost:8086 version 0.13.0
InfluxDB shell version: 0.13.0
> show databases
name: databases
---------------
name
graphite
_internal
flow_dc1
> use graphite
Using database graphite
> show measurements
name: measurements
------------------
name
hosts
total
>
发现没有测量，它应该是这样的：
> use graphite
Using database graphite
> show measurements
name: measurements
------------------
name
fastnetmon.10_1_2_137.incoming.flows
fastnetmon.10_1_2_137.incoming.mbps
fastnetmon.10_1_2_137.incoming.pps
fastnetmon.10_1_2_137.outgoing.flows
fastnetmon.10_1_2_137.outgoing.mbps
fastnetmon.10_1_2_137.outgoing.pps
fastnetmon.172_26_1_1.incoming.flows
fastnetmon.172_26_1_1.incoming.mbps
fastnetmon.172_26_1_1.incoming.pps
fastnetmon.172_26_1_1.outgoing.flows
fastnetmon.172_26_1_1.outgoing.mbps
fastnetmon.172_26_1_1.outgoing.pps
fastnetmon.incoming.mbps
fastnetmon.incoming.pps
fastnetmon.incomingflows
fastnetmon.outgoing.mbps
fastnetmon.outgoing.pps
fastnetmon.outgoingflows
> select * from "fastnetmon.incoming.pps" order by time desc limit 10
name: fastnetmon.incoming.pps
-----------------------------
time value
1465079546000000000 0
1465079545000000000 0
1465079544000000000 3
1465079543000000000 0
1465079542000000000 2
1465079541000000000 0
1465079540000000000 0
1465079539000000000 0
1465079538000000000 0
1465079537000000000 0
答案1
您已将 fastnetmon 配置为使用 netflow 和 sflow。您是否配置了基于网络流量生成 netflow 或 sflow 数据的工具？如果没有，则需要配置 fasnetmon 以检查接口流量，或将 fastnetmon 配置中的后端更改为可以读取接口统计信息的东西，例如 netmap 或 pf_ring。基本上，您产生数据应该与您的配置相匹配。