Tutorial: Flexible flow export via socketSink

In order to assure that no old or unnecessary plugins are being loaded please clean your plugin directory by

$ t2build -e
Plugin folder emptied

Unlike netflowSink, the socketSink plugin exports all plugin output, as it appears in any Sink plugin in binary, text or JSON. So compile all standard plugins for the beginning and remove txtSink, as we do not need it to duplicate output.

$ t2build

$ t2build -u txtSink

The anonymized sample PCAP being used here, can be downloaded here: faf-exercise.pcap. Please extract it under your ~/data folder.

SocketSink Configuration

First move to the socketSink directory and look into the configuration:

$ socketSink
$ vi socketSink.h

The default address to log is the local interface, if you want to log remotely change the address in SERVADD using t2conf:

$ t2conf socketSink -D SERVADD="s.h.i.t"

or leave it at local host. The following tutorial is using the default settings. Then recompile the plugin.

$ t2build socketSink

Now you’re all set.

Flow export to another IP

To collect T2 flow data open netcat in another window

$ nc -l -p 6666

Now start t2 with a pcap file on your local machine:

$ t2 -r ~/data/faf-exercise.pcap

or from an interface

$ st2 -i interface
[sudo] password for wurst:

Now you should see flows appearing in your netcat window.

Have fun!