Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
567 Views 3 Replies Latest reply: Jun 21, 2013 12:29 PM by brinkn RSS
jspanitz Apprentice 118 posts since
Nov 4, 2009
Currently Being Moderated

Jun 14, 2013 6:00 PM

Web Gateway Flow Data Support

I thought I asked this before but could not find it.  Is there support for flow (netflow, sflow, jflow, etc) data from MWG 7.x?  We really need this as a troubleshooting tool.

  • brinkn Newcomer 12 posts since
    Jan 13, 2011
    Currently Being Moderated
    1. Jun 21, 2013 9:36 AM (in response to jspanitz)
    Re: Web Gateway Flow Data Support


    OK, I thought this was a pretty cool idea. 

     

    /*Start Disclaimer

    I did this with a lab setup, and Im pretty sure it could cause performance impacts, and void you warranty, and potentially bring about the end of the know universe.

    End Disclaimer*/

     

    Here is what I did:

    Downloaded fprobe from: http://fprobe.sourceforge.net/

    I compiled fprobe on a development box and copied the ./src/fprobe file to my webgateway v7.3 box.

     

    I then started fprobe on the webgateway:

    ./fprobe -i INTERFACE_TO_MONITOR IP_OF_COLLECTOR:9995

     

    Low and behold it started sending netflow.

     

    Im sure there are a lot of other thnigs that can be done such as using fprobe-ulog, configuring fprobe to do multiple interfaces,  other formats, etc, but I figure this may get teh ball rolling any other people can throw out ideas as well.

  • eelsasser McAfee SME 841 posts since
    Mar 24, 2010
    Currently Being Moderated
    2. Jun 21, 2013 10:18 AM (in response to brinkn)
    Re: Web Gateway Flow Data Support

    I started to do the same thing, but got sidetracked and never finished. So kudos, Nick, on getting further.

     

    But as i thought about it, wouldn't the actual data that you are capturing only represent one flow from the client to the proxy, and another flow from the proxy to the site?

     

    I suspect John is trying to get the end-to-end relationship between client IP and web server IP. I'm not so sure that  will happen, even in transparent bridge.

     

    i don't know what raw netflow data looks like, so i am speculating.

  • brinkn Newcomer 12 posts since
    Jan 13, 2011
    Currently Being Moderated
    3. Jun 21, 2013 12:29 PM (in response to eelsasser)
    Re: Web Gateway Flow Data Support

    I think you are right.  I have been contemplating this since reading the OP.  I cant see any solution where you can get a Netflow V9 type packet where you know what the NAT translation is.  I am not running a transparent proxy so I dont know how the host is configured in that scenario, but using an explicit proxy I assume the mwg process does the translation from interfaces and does not depend on iptables for the routing.  So in my scenario I am not giving anything more then what you would get from the nearest switch.

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points