netbird icon indicating copy to clipboard operation
netbird copied to clipboard

Implement sFlow/NetFlow collection for reporting usage across the network

Open JonTheNiceGuy opened this issue 1 year ago • 2 comments

Is your feature request related to a problem? Please describe. As the administrator of my self-hosted NetBird environment, I am unable to determine whether traffic flows are entering and exiting the mesh without performing packet captures at the interfaces of all the relevant nodes in the cluster. Storing this data off-node allows for security audits related to ephemeral nodes.

Describe the solution you'd like It would be great if you could give the administrator the options of either using nothing (turning the feature off), or using the standard protocol of sFlow or NetFlow v9 aggregated at the dashboard/api (e.g. a new container running adjacent to the management/api container), by pointing sFlow/NetFlow v9 from cluster members to specific endpoints in the netbird up configuration (e.g. netbird up --flow 192.0.2.1:12345 or netbird up --flow sflow.example.org:12345), or perhaps introducing a new option along the same lines as the DNS configuration option pushed to the client.

If this is aggregated at a management service, then a simple query tool should be implemented, allowing source and destination addresses and ports to be filtered in a time window.

Describe alternatives you've considered Deploying an sFlow/NetFlow collector on each node as part of the deployment, however, this does not allow for mobile clients to be supported in this way.

Additional context May be useful for implementing the netflow format: netsampler/goflow2, cloudflare/goflow

JonTheNiceGuy avatar Oct 22 '24 09:10 JonTheNiceGuy