- nf_conntrack_status_v0.4-preview.png (279.16 KiB) Viewed 17855 times
DESCRIPTION
* conntrack.pl
* v0.4 (2014.01.04)
* by red_neon (red_neon [at] dcpp [dot] ru)
* Netfilter Conntrack Status [ tcp / udp / icmp / igmp / other ]
* Shows all current connections on the linux gateway\server
* it uses the netfilter conntrack module:
* http://www.frozentux.net/iptables-tutor ... ACKENTRIES
* Linux kernel version must be >= 2.6.18
=======================================================================
CHANGES
Netfilter Conntrack Status 0.4 - 2013.01.04:
1. added: method getting of stats via conntrack-tools (conntrack) by default
2. added: experimentally, realtime-mode to use with realtime plugin (only via conntrack-tools)
3. added: ipv6 support (graph shows sum of connections ipv4+ipv6)
4. added: tcp-flags: SYN_SENT2 (Linux kernel >= 2.6.31), NONE and Unknown (connections that not entered in previous. see tcp-flags info)
5. added: localhost filter for ignore src|dst=127.0.0.1|::1 connections
6. changed: now in crontab conntrack.pl must run with root privileges, because it need for conntrack-tools
7. changed: removed the need for commands in rc.local, added loading of modules nf_conntrack* via /etc/modules
8. chanded: on all graphs: "GPRINT Type" changed to some modified "Normal" (for good reading >1k connections), "Minimum" has been replaced on "Average"
9. changed: all templates have been renamed to "Netfilter Conntrack Status"
10. chanded: on the graph "Netfilter Conntrack Status - TCP" have been changed some colours
How to update previous version 0.3:
1. remove from /etc/rc.local:
/bin/chmod +r /proc/net/nf_conntrack
/bin/chmod +r /proc/net/ip_conntrack
2. in /etc/crontab
replace old string with one new (see INSTALLATION)
Next, as in instruction below.
=======================================================================
INSTALLATION
[REMOTE-SERVER SIDE]
[1] conntrack script
Copy conntrack.pl
from: conntrack_status_v0.4/remote_server/
to: /etc/srv_scripts/ (create if not exists)
set rights for execute:
$ chmod +x /etc/srv_scripts/conntrack.pl
[2] iptables (Linux kernel version must be >= 2.6.18)
$ modprobe nf_conntrack
$ modprobe nf_conntrack_ipv4
if you use ipv6:
$ modprobe nf_conntrack_ipv6
Load modules on boot:
$ echo "nf_conntrack" >> /etc/modules
$ echo "nf_conntrack_ipv4" >> /etc/modules
if you use ipv6:
$ echo "nf_conntrack_ipv6" >> /etc/modules
[3] note
On highload gateways reading of /proc/net/nf_conntrack
takes a lot of time and possibly can cause freeze.
To solve this problem - install conntrack-tools
(http://conntrack-tools.netfilter.org/)
To see how much connections now (safely):
$ cat /proc/sys/net/netfilter/nf_conntrack_count
[3a] stats via conntrack-tools
On Debian-based system:
$ apt-get install conntrack
RPM:
$ yum install conntrack-tools
Check, that "$_mode = 1" in this script below.
Ok. Go to pat.[4]
[3b] stats via /proc/net/nf_conntrack (NOT RECOMMENDED)
Use this method on server with < 10k connections at the same time.
Set "$_mode = 0" in this script below.
[4] first run
checking:
$ /usr/bin/perl /etc/srv_scripts/conntrack.pl
if is all ok - you will see stats.
$ cat /tmp/conntrack.stat
[5] snmpd
Put into snmpd.conf string with exec:
$ nano /etc/snmp/snmpd.conf
exec conntrack /bin/cat /tmp/conntrack.stat
restart snmpd:
$ /etc/init.d/snmpd restart
[6] cron
$ nano /etc/crontab
*/5 * * * * root /bin/sleep 290; /usr/bin/perl /etc/srv_scripts/conntrack.pl cron >/dev/null 2>&1
Script will get connections status every 5 mins, then it will get data and save them into temporary file in /tmp/ directory.
You can change directory and name of temporary file in script-settings below ($_tempfile),
do not forget to change string with exec the snmpd.conf
[CACTI-SERVER SIDE]
[7] cacti script
Copy snmp_execscripts.php
from: conntrack_status_v0.4/cacti_dir/scripts/
to: cacti/scripts/
[8] cacti templates
Import templates from conntrack_status_v0.4/cacti_web_templates/ in Cacti:
[EXPERIMENTALLY]
Show realtime statistics (Cacti-plugin: Realtime Graph Viewer) (only with conntrack-tools):
a) install "sudo"
$ apt-get install sudo
b) give root privileges for run this script from snmp user
$ visudo
snmp ALL = NOPASSWD:/etc/srv_scripts/conntrack.pl
c) edit snmpd.conf (replace old string, see pat.[5])
$ nano /etc/snmp/snmpd.conf
exec conntrack /usr/bin/sudo /etc/srv_scripts/conntrack.pl realtime
d) restart snmpd:
$ /etc/init.d/snmpd restart
e) remove task-string in /etc/crontab (see pat.[6])
=======================================================================
Last update: 2015.04.07
reason: attached new snmp_execscripts.php for new versions of Net-SNMP with "extend" only option.
Replace snmp_execscripts.php on new and change "exec" to "extend" in snmpd.conf
red_neon
