The option is configured or disabled by parameters in configuration file /etc/dpi/fastdpi.conf.

To switch on the export of statistics:

netflow=1

• 0 or no parameter - export disabled;
• 1 - export statistics by protocols (port numbers);
• 2 - export statistics by directions (independent systems' numbers);
• 4 - export statistics for billing;
• 8 - export the complete statistical information on sessions;

The network interface name to export netflow with statistics:

netflow_dev=eth2

Data export period in seconds:

netflow_timeout=10

IP address and port number of netflow collector for statistics by protocols:

netflow_collector=192.168.0.1:9997

IP address and port number of netflow collector with statistics by directions:

netflow_as_collector=192.168.0.1:9998

Directions to collect and aggregate data:

• 1 for external independent systems only (OK for household operators as there are no other independent systems rather than the operator itself on one side);
• 2 for internal independent systems only;
• 3 = 1 + 2 for both (OK for transit operators. However, as the aggregation by AS is made separately, data would be counted twice in the exported statistics - for each of AS participating in data transmission).

netflow_as_direction=1

IP address and port number of NetFlow collector with statistics for billing. One has to specify the separate collector to avoid data messing with other statistics:

netflow_bill_collector=192.168.0.1:9995

Setting up the statistics format:

netflow_bill_collector_type=2

• 0 - netflow_v5 ( default )
• 1 - ipfix udp
• 2 - ipfix tcp

The whole traffic volume is counted by default. This includes packet headers as well. In order to count the useful traffic only¹⁾ please specify:

netflow_bill_method=1

The traffic class assigned by DPI is specified in TOS field of netflow with billing statistics. This information can be used to create attractive billing plans.

IP address and port number of netflow collector with full statistics. One has to specify the separate collector to avoid data messing with other statistics:

netflow_full_collector=192.168.0.1:9996
netflow_passive_timeout=30
netflow_active_timeout=300

Here

• netflow_passive_timeout=30 - is the time to wait for session activity. If no activity in this time, the session is treated as closed and its information is transmitted
• netflow_active_timeout=300 - is the time to report on the long sessions: in fact, such sessions are split into fragments of this duration.

The complete statistics preserved original port numbers. The information on detected protocols is sent in normally empty bytes 46-47. In case one needs to analyse the protocols in use, the system can be configured to send the protocol information in the port number:

netflow_full_port_swap=1

In order to smooth such peaks and load the collector in a uniform way one can set the parameter:

netflow_rate_limit=60

Here 60 is the maximal netflow rate in Mb/s.

An example is described in the section QoE Stor: DPI Configuration