安装Tstat

下载tstat包下载地址下载好之后放到/opt下

安装需要的依赖

apt-get install autoconf automake libtool

apt-get install flex byacc

使用tstat还需要lipcap工具下载地址下载好之后放到/opt 下

tar zxvf libpcap-1.9.1.tar.gz

cd libpcap-1.9.1

./configure

make

make install

然后进入tstat目录

cd tstat-3.0

./configure

make

make install

如果启动报错 libpcap.so.1之类的

解决：这是因为libpcap.so.1默认安装到了/usr/local/lib下，我们做一个符号链接到/usr/lib/下即可。

sudo ln -s /usr/local/lib/libpcap.so.1 /usr/lib/libpcap.so.1

到这里tstat安装完毕学习链接如何使用

eg 统计mon1口的数据，使用globals.conf配置统计数据在xiangwen目录

安装RCDcap

这个有个脚本可以使用

#!/bin/bash

# ver0.2

#Check network connectivity

ping -c 1 8.8.8.8 &>/dev/null

[ "$?" != 0 ] && echo "Detected problem with network connecitivity, exiting" && exit 1

cd ~

#Install Mercurial

sudo apt-get -y install mercurial

hg clone http://hg.code.sf.net/p/rcdcap/code rcdcap-code

#Install PFRING

sudo apt-get -y install build-essential bison flex linux-headers-$(uname -r)

#Get PF_RING version and download it

pfarch=$(curl -s https://sourceforge.net/projects/ntop/files/PF_RING/ | grep -wo -m 1 "PF_RING-.*.tar.gz")

wget https://sourceforge.net/projects/ntop/files/PF_RING/"$pfarch"

[ ! -f "$pfarch" ] && echo "Can't locate '$pfarch', exiting" && exit 1

#Remove .tar.gz suffix from $pfarch

pf="${pfarch%.tar.gz}"

#Extract PF_RING archive

tar zxvf "$pfarch"

cd "$pf"

make

cd kernel

sudo make install

cd ../userland/lib

sudo make install

sudo modprobe pf_ring

#Check if PF_RING module is loaded in kernel

lsmod | grep pf_ring &>/dev/null

[ "$?" != 0 ] && echo "Can't load module pf_ring, exiting" && exit 1

cd ~

#Install dpendencies for RCDCAP

sudo apt-get -y install build-essential cmake libboost1.58-dev libpcap-dev doxygen libboost-system1.58-dev libboost-program-options1.58-dev libboost-filesystem1.58-dev libboost-thread1.58-dev libboost-system1.58-dev libboost-regex1.58-dev libboost-test1.58-dev

mkdir build-make

cd build-make

cmake -G"Unix Makefiles" ../rcdcap-code/source

make

cpack -D CPACK_DEB_PACKAGE_DEBUG=1 -D CPACK_PACKAGE_CONTACT="Zdravko Velinov <z.velinov@vkv5.com>" -G DEB

[ ! -f ~/build-make/RCDCap*.deb ] && echo "Can't locate RCDCap package in dir build-make, exiting" && exit 1

#Download and install libboost1.48 dependencies

wget http://cz.archive.ubuntu.com/ubuntu/pool/universe/b/boost1.48/libboost-program-options1.48.0_1.48.0-3_amd64.deb

wget http://cz.archive.ubuntu.com/ubuntu/pool/universe/b/boost1.48/libboost-thread1.48.0_1.48.0-3_amd64.deb

wget http://cz.archive.ubuntu.com/ubuntu/pool/universe/b/boost1.48/libboost-system1.48.0_1.48.0-3_amd64.deb

[ ! -f libboost-program-options1.48.0_1.48.0-3_amd64.deb ] && echo "Can't locate 'libboost-program-options1.48.0_1.48.0-3_amd64.deb', exiting" && exit 1

[ ! -f libboost-thread1.48.0_1.48.0-3_amd64.deb ] && echo "Can't locate 'libboost-thread1.48.0_1.48.0-3_amd64.deb', exiting" && exit 1

[ ! -f libboost-system1.48.0_1.48.0-3_amd64.deb ] && echo "Can't locate 'libboost-system1.48.0_1.48.0-3_amd64.deb', exiting" && exit 1

sudo dpkg -i libboost-program-options1.48.0_1.48.0-3_amd64.deb && rm libboost-program-options1.48.0_1.48.0-3_amd64.deb

sudo dpkg -i libboost-thread1.48.0_1.48.0-3_amd64.deb && rm libboost-thread1.48.0_1.48.0-3_amd64.deb

sudo dpkg -i libboost-system1.48.0_1.48.0-3_amd64.deb && rm libboost-system1.48.0_1.48.0-3_amd64.deb

#Install RCDCAP

sudo dpkg -i ~/build-make/RCDCap*.deb

#Check if rcdcap binary exists

if [ -f /usr/bin/rcdcap ]; then

echo "Installation succesfull, use command '/usr/bin/rcdcap'"

exit 0

else

echo "Installation is not succesfull"

exit 1

如果没有成功，那就手动安装，但是不出意外pf_ring 这个是可以装好的。

先下载几个依赖

wget http://cz.archive.ubuntu.com/ubuntu/pool/universe/b/boost1.48/libboost-program-options1.48.0_1.48.0-3_amd64.deb

wget http://cz.archive.ubuntu.com/ubuntu/pool/universe/b/boost1.48/libboost-thread1.48.0_1.48.0-3_amd64.deb

wget http://cz.archive.ubuntu.com/ubuntu/pool/universe/b/boost1.48/libboost-system1.48.0_1.48.0-3_amd64.deb

安装

sudo dpkg -i libboost-program-options1.48.0_1.48.0-3_amd64.deb && rm libboost-program-options1.48.0_1.48.0-3_amd64.deb

sudo dpkg -i libboost-thread1.48.0_1.48.0-3_amd64.deb && rm libboost-thread1.48.0_1.48.0-3_amd64.deb

sudo dpkg -i libboost-system1.48.0_1.48.0-3_amd64.deb && rm libboost-system1.48.0_1.48.0-3_amd64.deb

下载最新安装包下载地址

放到/opt 目录下解压

创建build-make 目录

mkdir build-make

cd build-make

cmake -G"Unix Makefiles" ../*Source

make

cpack -D CPACK_DEB_PACKAGE_DEBUG=1 \

-D CPACK_PACKAGE_CONTACT="Zdravko Velinov <z.velinov@vkv5.com>"\

-G DEB

sudo dpkg -i RCDCap-*.deb

安装完成

学习链接学习链接

Ubuntu16.04安装tstat RCDcap分析erspan报文

Ubuntu16.04安装tstat RCDcap分析erspan报文

安装Tstat

安装RCDcap