How to generate netflow data in linux

Solution 1:

You should check IPT-NETFLOW, it seems exactly what you need implemented as a kernel module for IPTABLES. It is actively maintained and used succesfully in some ISP so should be good enough. Documentation could be better though (look into README file).

Solution 2:

ntop will do it, but is probably not the best choice. Definitely check out pmacct; it's designed exactly for this. From the feature list:

  • Collects data through libpcap, Netlink/ULOG, NetFlow v1/v5/v7/v8/ - v9, sFlow v2/v4/v5 and IPFIX
  • Saves data to a number of backendsincluding memory tables, MySQL, PostgreSQL, SQLite and BerkeleyDB
  • Exports data to remote collectors through IPFIX, NetFlow v5/v9 andsFlow v5
  • Replicates incoming IPFIX, NetFlow and sFlow packets to remote collectors

Among many other things.