
1.  Requirements.
1a. Software Requirements
 One of these platforms: Linux, Solaris or FreeBSD.
 perl - Required to run ProcessASN.pl 
 An ANSI C compiler (like gcc)
 gnu make (sorry, I don't know how to work the other one)
 wget, curl, or ncftp.  Otherwise, you will have to download the following
   files manually and put them in the ehnt directory:
	ftp://ftp.arin.net/netinfo/asn.txt
	ftp://ftp.apnic.net/pub/apnic/dbase/data/apnic.an.gz
	ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.an.gz
 glib - This is a new requirement.  Sorry.  I needed the hash table.

1b. Hardware Requirements
 ehntserv requires minimal memory.  CPU requirements depend on flow volume.
 Things are a bit different for the ehnt client.  Software developers are
 often forced to choose between processor and memory efficiency.  A program
 may be designed to use clever data structures which reduce processor
 utilization.  On the other hand, a program may do processing which allows
 less memory to be utilized.  Well, with  ehnt I have managed to create
 a program that not only uses excessive memory, but uses huge amounts of
 cpu as well!  The ehnt client currently uses about 16M.  Ongoing cpu
 depends on flow volume, while report generation uses gobs of cpu.  Things
 run quite comfortable on a dual 667mhz Intel box with 512M.

 ehnt requires about 10M of disk space.

2.  Set up flow exporting on your router
2a.  Set up flow exporting on your cisco.

This config works for me on 12.0(10)S.  Be sure to replace my two bogus
sample interface names with whatever interfaces you want to see flows for.
Keep in mind that flows are uni-directional, and on Ciscos are tracked only
on input.  If you need to monitor flows going in and out of a given interface,
you must enable flow-exporting on that interface, plus every interfaces that
sends traffic to it.

! ----- Start sample Cisco IOS config -----
!
interface FastEthernet w/x
 ip route-cache flow
!
interface Serial y/z
 ip route-cache flow
!
ip flow-export source loopback0
ip flow-export version 5 origin-as
!
!replace www.xxx.yyy.zzz with your EHNT server IP address, replace
!pppp with your EHNT server port number (I use 4444).
ip flow-export destination www.xxx.yyy.zzz pppp
! ----- End sample Cisco IOS config -----

If you are seeing AS 0 too much coming from a Cisco, check out
http://www.caida.org/tools/measurement/cflowd/newfaq.xml under
"Concerning AS 0". 

2b.  Set up flow exporting on your Juniper.

According to the Juniper docs, you need an IP-II ASIC to do this.  I haven't
actually done this yet, please let me know whether or not it works.  Replace
iiiii and u with whatever interface and unit numbers you want.  As above,
replace www.xxx.yyy.zzz and pppp with your EHNT server address and port.

! ----- Start sample JunOS config -----
set firewall filter cflow_filter term term1 then sample
set firewall filter cflow_filter term term1 then accept

set interfaces iiii unit u family inet filter input cflow_filter

set forwarding-options sampling input family inet rate 1
set forwarding-options sampling output cflowd www.xxx.yyy.zzz port 4444
set forwarding-options sampling output cflowd www.xxx.yyy.zzz version 5
set forwarding-options sampling output cflowd www.xxx.yyy.zzz as-type origin
! ----- End sample JunOS config -----

2c.  Set up flow exporting on your Foundry.

I have not done this.  I don't really know anything about it.  I don't even
know if Foundry supports netflow v5, which is what EHNT uses.  Let me know
if it works and what the commands are!

3.  Configure EHNT

  Edit config.h.  The default IP address is probably best, but you may
    want to change the UDP and TCP port numbers.

  Edit Makefile.  Make sure your system type is uncommented.  Sorry, only
    LINUX, SOLARIS and FreeBSD are currently options.  (Not that these 
    options do much; porting to other Unixes with sockets should be a snap.)

4.  Download asn.txt (and friends).

  EHNT turns AS numbers into text, but only if you have asn.txt.  EHNT ships
    with an asn.txt, but it is probably out of date.  Download the latest
    asn.txt from ftp://ftp.arin.net/netinfo/asn.txt before building the
    software.

  New: Also download the RIPE and APNIC AS lists from
    ftp://ftp.apnic.net/pub/apnic/dbase/data/apnic.an.gz
  and 
    ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.an.gz

5.  Compile EHNT.

  You need GNU make.  Simple type "make" (or "gmake").  

6.  Install EHNT.

  If the compile worked, you are ready to use ehnt.  There is currently
    no "make install";  feel free to copy the binaries (ehntserv and ehnt)
    anywhere you want.  Note that the client (ehnt) looks for asnc.txt in
    the current working directory.  If it can't find it, ASN translation
    won't happen.

7.  Run EHNT.  Command-line help (-h) should be fairly self-explanatory.

  Run the server:

	./ehntserv

  Get command line help for the client:

        ./ehnt -h

  Run the client in dump mode.  This example converts AS 0 into 54321,
  and only shows SMTP (port 25) flows to/from AS 701.

	./ehnt -s localhost:4444 -m dump -0 54321 -p 25 -a 701

  Run the client in report mode.  This example looks at a particular
    interface on a particular router.  In this case, it is whatever
    interface has the SNMP ifIndex of 4.  (If you don't know how to get
    the ifIndex, try installing the way nifty NET-SNMP
    (http://net-snmp.sourceforge.net) suite and running snmpwalk on your
    router.)

	./ehnt -s myserver:4444 -m top -0 54321 -r 10.2.3.4 -n 4