tristansullivan / flowd_tristan

Network flow and packet marking service written in Python

Network flow and packet marking service

flowd is a network flow and packet marking service developed based on the technical specification. It provides a pluggable system to test different flow/packet marking strategies using plugins to generate flow identifiers and a set of backends that implement the actual packet and flow marking. Plugins and backends run in parallel and are synchronised using a multiprocessing queue (this can be extended to process pools in the future). There is also initial support for systemd/journal integration (Linux daemon), docker image and development environment, STUN/TURN IP detection and configuration.

The following plugins are currently available:

• netstat - scans the network connections on a host, filters out private/local network and generates a flow identifier with the experiment provided in the configuration (partial tagging).
• np_api - API based on named pipe (/var/run/flowd) that can be used to directly pass the flow identifiers to flowd.

The following backend is provided:

• udp-firefly - initial implementation of the UDP firefly packets.

This project is in alpha stage and does not have any official release yet.

Development environment

Containerised version of the flowd development environment is provided for a quick start. Please fork the flowd repository and add the mainstream as an additional remote in order to be able to submit a merge request later.

flowd can be build with the following command:

docker build -t <image>:<tag> .

and can be started with:

docker run --privileged --network=host -it -v /<local_fork_path>/flowd:/usr/src/app \
           --entrypoint=/bin/bash <image>:<tag>  

Before staring the service an initial configuration needs to be added in /etc/flowd/flowd.cfg (please check an example etc/flowd.cfg). To start the service run:

sbin/flowd --debug

Contribution guide

TBA