Read netflow/rflow (dd-wrt) packet content

Question

I'm currently developing an IDS/IPS that uses NetFlow data to draw assumptions whether there is an ongoing attack. I didn't afford an expensive CISCO router so I bought a LINKSYS router on which I installed DD-WRT. DD-WRT sends netflow v5 packets to your preferred machine so it's like having a CISCO router but older. Basically you get a $200-$500 router for $80 and a little tweaking. I've set up the router, I'm getting the packets, I even used the DD-WRT provided tool for capturing rFlow (they named it like that but it's netflow v5) and everything works.

My application will have to do everything internally so that means i need to capture rflow packets, read them and draw the assumptions based on my readings. I started developing in JAVA and set up a UDP daemon to listen on 2055 (port for receiving rflow packets). All good, i'm getting the packets but when i try to view the content i get some weird characters, like I'm dumping stuff from memory.

Here's my code for setting up the deamon and reading data.

try {
            serverSocket = new DatagramSocket(2055);
            while (true) {
                DatagramPacket receivedPacket = new DatagramPacket(received, received.length);
                serverSocket.receive(receivedPacket);
                ByteArrayInputStream byteIn = new ByteArrayInputStream(receivedPacket.getData(),0,receivedPacket.getLength());
                DataInputStream in = new DataInputStream(byteIn);
                String input = "";
                while( (input = in.readLine()) != null) {
                    System.out.println(input + "\n");
                }
                Inet4Address from = (Inet4Address) receivedPacket.getAddress();
                System.out.println("FROM: " + from + "\nDATA: " + data[4]);
            }
        } catch (SocketException ex) {
            System.out.println(ex.getMessage());
        }

I have found a library called jflow..but there is no source code so i'm pretty skeptical on using it. I was wondering if somebody can tell me how can i actually read the content of the packets being sent to me. Since i'm at an early stage of development I am not bound to use JAVA, i could go for C++. My biggest problem, no matter the programming language is how to read the content of those packets so that I can draw the correct conclusions that i need for my other modules.

Answer 1

The rFlow / NetFlow v5 packets are a binary packet layout, so viewed as text they will appear, well, unreadable.

The packet format for the v5 packets is known, and can be found with a google search. This seems a good reference.

Note that the rFlow daemon on the dd-wrt has a long standing bug where it does not fill in the input or output interface fields correctly.