Скачать или смотреть MIMIC NetFlow Simulator: Exercise OpenObserve NBAR alerts

Configure MIMIC to test OpenObserve alerts in 2 minutes:

0:00 Install MIMIC UpdateWizard package MYNETFLO , which includes NBAR configurations

0:20 Configure default agent 1 with NETFLOW protocol and select nf_nbar2_v9.cfg

0:37 Configure netflow export destination and port 2055 that is the default collector port of goflow2

0:58 The nf_nbar2_v9.cfg is scripted to simulate a data-only network's flows without DSCP EF traffic in the ACTION.mtcl script

1:03 According to VOIP hardware phone manufacturer cisco.com documentation, 101110 is for DSCP EF traffic for VOIP RTP traffic

1:34 Use any binary converter to obtain the decimal number 184 for simulating EF VOIP traffic's TOS field

1:38 ACTION.mtcl script shows neither VOIP DSCP46 nor TOS184 is included in the simulation rotation, which means that normally nf_nbar2_v9.cfg does not export hardware VOIP traffic. ACTION.mtcl shows agent store variables ip_dscp and src_tos as the control variables for NBAR field

1:40 Configure the 2 agent store variables, ip_dscp and src_tos, to trigger hardware VOIP traffic simulation

1:46 Start agent 1 and configure openobserve.ai alert with a Name string, logs as Stream Type, "default" as Stream Name

1:59 Select Real-Time alert and ip_tos greater equal 184 as the trigger; alert email destination is configured with the administrator silhouette icon

2:09 After waiting for full 5 minutes, an alert email is sent from openobserve.ai to gmail, which shows notification bald text "Inbox (1)" for the simulated NBAR VOIP NetFlow