Nfcapd forwards to second collector but we lose exporter IP info

[luminous706]

All of my exporters are sending to nfcapd, and nfcapd forwards to a second collector (ManageEngine). I like this because nfcapd offers a lot of flexibility over our commercial collector.

The major problem now is that I cannot sort the flows by exporter IP as ManageEngine thinks all flows come from nfcapd.

Is there a way to make nfcapd spoof the IP of the exporters somehow?

I know there is a field that netflow proxies use sometimes called "exporterIPv4Address". When using the -R option, could this field be added to the forwarded records?

Thanks!

[phaag]

nfcapd does not modify the packet content. Therefore it does not add exporterIPv4Address into the stream. One option may be spoofing the sending IP, pretending the packet comes from the original source. This would imply to run nfcpad as root or priv-sep two processes. Furthermore spoofing may trigger all sort of network monitoring systems. If this is all fine with you I can think about a possible implementation.

[luminous706]

Hello,

Triggering monitoring systems is not an issue for us, the forwarding will be done on a LAN. It would be great if you could provide a few directions to set this up!

We are using something similar for our log collection. Everything goes into rSyslog, then rSyslog forwards to a SIEM. The SIEM was seeing everything coming from rSyslog instead of the original devices, which is not perfect because some devices don't put their names properly in the log messages. rSyslog has a UDP spoof module, easy to load and use. Maybe this is something that could also be implemented permanently in Nfcapd in the future, if you have the time of course : )

Thanks a lot for the help!

[luminous706]

Hello, just wondering if you were able to think about a way to achieve this? Just wanted a quick friendly update : )

Thank you!

[phaag]

Sorry for being late - Need more time. If you need a quick fix, check for samplicator for now

[ale91x]

• I would like such a feature in nfreplay.

[luminous706]

Hello, do you know if this feature will come at any point? I need to use Samplicator to repeat the flows to an external collector, I would rather use Nfcapd instead.

[phaag]

Yes - it is still on the todo list.

[phaag]

The master repo is updated with IP spoofing for the packet repeater. It's enabled with option -A. See nfcapd(1) Please check and report back.

[phaag]

Issue closed. Feel free to reopen, if you run into problems.

[luminous706]

The master repo is updated with IP spoofing for the packet repeater. It's enabled with option -A. See nfcapd(1) Please check and report back.

Hello, thank you very much for this feature, I will try it very soon!