Ben's notes

Linux, Unix, network, radio...

User Tools

Site Tools


FlowViewer on CentOS 7

This page describes the installation of FlowViewer on CentOS 7 for NetFlow reporting.

Quote FlowViewer wiki: “FlowViewer has been developed for NASA’s Earth Sciences Data and Information System (ESDIS) networks, and credit goes to NASA for their usual outstanding support of innovation.”


  • Install development tools:
    yum groupinstall development tools
    yum install glib2-devel
  • Install libraries and source code:
    yum install zlib zlib-devel lzo lzo-devel libpcap libpcap-devel gnutls gnutls-devel python-devel c-ares c-ares-devel openssl-devel 
  • Install webserver and dependencies:
    yum install httpd gd perl-GD perl-GDGraph perl-GDTextUtil rrdtool
    systemctl enable httpd
    systemctl start httpd
  • Download, compile and install libxbuf from
    tar zxvf libfixbuf-1.6.2.tar.gz
    ./configure && make && make install
  • Download, compile and install netsa from
    tar zxvf netsa-python-1.4.3.tar.gz
    python build
    python install
  • Download, compile and install libipa from
    tar zxvf ipa-0.5.2.tar.gz
    ./configure && make && make install
  • Add /usr/local/lib to library path.
    echo /usr/local/lib >>/etc/
    ldconfig -v

Install SiLK

  • Download SiLK from:
  • Extract tar.gz file:
    tar zxvf silk-3.10.1.tar.gz
  • Configure and compile:
    mkdir -p /opt/silk/data
    ./configure \
              --enable-data-rootdir=/opt/silk/data \
              --prefix=/opt/silk \
              --enable-output-compression \
              --with-libipa=/usr/local/lib/pkgconfig \
    make install
    Example site configuration files have been installed in
    Choose the file that matches your packing logic plug-in
    and/or installation, rename it to silk.conf, customize it,
    and copy it to the root of the data directory:

Configure SiLK

  • Create /opt/data/silk.conf:
    cp /opt/silk/share/silk/twoway-silk.conf /opt/silk/data/silk.conf
  • Edit silk.conf for example:
    sensor 0 uplink    "Uplink"
    class all
        sensors uplink
    end class
  • Specify local address space:
    cd /opt/silk/share/silk
    cp addrtype-templ.txt addresses.txt
    vi addresses.txt
      # My IP space (CMU)        internal
    /opt/silk/bin/rwpmapbuild --input addresses.txt --output address_types.pmap
  • Install Country Code mapping (legacy format). Download CSV from
    unzip -p | \
              /opt/silk/bin/rwgeoip2ccmap --csv-input > country_codes.pmap
    cp country_codes.pmap /opt/silk/share/silk/country_codes.pmap
  • Create /opt/silk/data/sensor.conf:
    probe uplink netflow-v9
         listen-on-port 9901
         protocol udp
    end probe
    sensor uplink
         netflow-v9-probes uplink
         external-ipblock remainder
    end sensor
  • Create /opt/silk/etc/rwflowpack.conf:
  • Enable (legacy) service:
    cp /root/silk-3.10.1/src/rwflowpack/rwflowpack.init.d /etc/init.d/rwflowpack
    chkconfig rwflowpack on
    service rwflowpack start

Configure NetFlow v9 for RouterOS

  • Put source in trusted zone, add udp port:
    firewall-cmd --permanent --zone=trusted --add-source=
    firewall-cmd --permanent --zone=trusted --add-port=9901/udp
    firewall-cmd --reload
    firewall-cmd --zone=trusted --list-all
  • On RouterOS add flow config:
    /ip traffic-flow target add version=9 address=
    /ip traffic-flow set enabled=yes interfaces=bridge1-uplink
    /ip firewall filter chain=output action=accept protocol=udp dst-address= dst-port=9901

Test query

  • Test SiLK with a query:
    /opt/silk/bin/rwfilter --sensor=uplink --proto=0-255 --pass=stdout --type=all | /opt/silk/bin/rwcut | tail

Install FlowViewer

  • Open port to webserver:
    firewall-cmd --permanent --zone=trusted --add-service=http
    firewall-cmd --reload
    firewall-cmd --zone=trusted --list-all
  • Untar into /var/www/cgi-bin subdirectory:
    cd /var/www/cgi-bin
    tar xvf /root/FlowViewer_4.6.tar
  • Configure variables as necessary.
  • Allow write access for FlowViewer:
    semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowGrapher(/.*)?"
    semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowMonitor(/.*)?"
    semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowViewer(/.*)?"
    semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowViewer_Dashboard(/.*)?"
    semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/FlowViewer_Saves(/.*)?"
    restorecon -Rv /var/www/html
  • Create all necessary directories with proper permissions.
  • Copy FlowViewer.css, FlowViewer.png to $reports_directory.
  • Start FlowMonitor_Collector, FlowMonitor_Grapher in background.
  • Point browser to FV.cgi
flowviewer_centos7.txt · Last modified: 2021/10/09 15:14 by