Reading “Network Flow Analysis” by Michael W Lucas.

For a long time I had a copy of “Network Flow Analysis” by Michael W Lucas, and I finally got to reading it.

1. Body

1.1. References

  1. softflowd :: sensor (https://www.mindrot.org/projects/softflowd/)
  2. flow-tools :: collector
  3. host-sflow :: sensor (https://github.com/sflow/host-sflow/)
  4. sflowtool :: collector/proxy
  5. xenoeye :: collector/grapher
  6. flowd :: collector (https://www.mindrot.org/projects/flowd/)

1.2. What is a flow?

A flow is a tuple /src_ip:port dst_ip:port IP_protocol/

We collect them because we cannot collect all the data dumped from an interface by tcpdump, it’s too much data. So, a flow is an abridgement of this info.

1.3. Where to put flow sensors and collectors?

Sensors can be routers or smart switches. The less the better, but you would probably want to cover all of your network. For a small network probably one collector is enough.

1.4. How to start using it.

  1. Sensor :: softflowd
  2. Collector :: flow-tools

Keep in mind that flow-tools is dead.

Anyway, create flows by: 

softflowd -d -i eth0 -t maxlife=300 -n 192.168.1.1:5678

Collect flows by: 

flow-capture -p /run/flow-capture.pid -n 287 -w /var/db/flow-tools/ -S 5 0/0/5678

The book is outdated, it says that a flow collector requires its own dedicated (which usually means “mirrored”) network interface, but this is not the case in 2026.

flow-capture will write logs into /var/db/flow-tools/, where you can analyse them.

1.5. A more hipsterish setup

Use softflowd to measure flows, netflow2ng to collect flows, and ntop-ng to display them.

In small home networks there are usually just a few switches, and probably just one router.

ISP routers often do not support either flows, or SNMP.

1.6. Watch human-readable flows

flow-cat ft* | flow-print -n

Filtering works with flow-nfilter: 

flow-cat ft* | flow-nfilter -Fudptcp | flow-print -n

Filters are defined in /etc/flow-tools/filter.cfg

Can filter on ip, port, subnet, protocol, and, less obviously, date, numeric params and a lot of other stuff.

Aggregate reports are created via flow-report, which looks at /etc/flow-tools/stat.cfg. 

flow-cat * | flow-report

1.7. GUI

Lucas suggests using CFlow and FlowTracker. I also tried ntop-ng and netflow2ng.

If those are still not enough, there are libraries to work with flows from most languages.

1.8. Afterword

This book is one of the most sysadmin-oriented books of his. Even though I understood quite a lot about the sysadmin mindset from it, as well as discovered a few missing links between different “knowledge chunks” I had known before, but couldn’t fit into my worldview, most of its value turned out to be inapplicable to my setups.

I am not a sysadmin, and the few tricks I know are either to understand what kind of mindset the IT people that I deal with at work have, or to setup my small home network (people online call their networks “homelabs”, but mine isn’t even a lab).

It is good that the book is, as typical for Lucas, equipped with humour and work anecdotes, which makes it less boring than it could be.

It is also good that his logic follows a rigourous logic of a techinical document:

  1. Basic theory,
  2. Data collection,
  3. Data filtering,
  4. Data aggregation,
  5. Data visualisation,
  6. Programming with data,
  7. Common pitfalls.

I wish more technical books were written with such clarity, in the domains that I am more interested in.